似水年華

搶救「統一發票兌獎」APP 資料

2024-08-22T23:45:00+08:00

臺灣財政部出品的統一發票兌獎近期更新後，需要重新登入，且手動掃描/輸入的發票，與超過一定期限的電子發票資料皆消失。Google Play 的部份相關評論下有以下回覆：

您好，因Google官方授權通訊協定(OAuth)政策異動，原兌獎APP之安卓裝置將無法進行備份，故新版本配合調整相關協定以符合Google政策要求，致安卓手機於更版後會有自動登出現象。有關會員卡及掃描/手動輸入發票，倘有自行「登出選保留」或有進行「資料備份」者皆能保有資料，若無進行上述操作則資料將無法還原，造成不便，尚祈見諒。

根據我的分析，原有數據都還在，只是新版 APP 不會去使用，因此一個可能的解法是使用 adb install -d 降級回舊版 APP，再將資料備份。然而，較久遠以前的電子發票仍無法存取。對此，若已取得 Android 系統的 root 權限，則可手動將舊版 APP 資料轉換為新版格式，以還原所有資料。

Data migration steps

Close and force stop the app to avoid data corruption during migration

Get the old database

cp -iv /data/data/tw.gov.invoice/files/InvoiceApp.db3 /sdcard/

Find out the old database key

cat /data/data/tw.gov.invoice/files/uuidFile

Open the old database in SQLite Browser. Here the old database is encrypted with the key found in the previous step using SQLCipher 3 defaults.

Find out the new database key

cat /data/data/tw.gov.invoice/files/uuidFile.uuid

Migrate the database to use the new key and SQLCipher 4 defaults. It can be done in SQLite Browser via Tools -> Set Encryption. Note that after this step SQLite Browser will reload the database, which now needs the new key and new defaults.

Make a backup of the database at the new path

mv -iv /data/data/tw.gov.invoice/files/.config/InvoiceApp.db3{,.bak}

Copy the migrated database to the new path

cp -iv /sdcard/InvoiceApp.db3 /data/data/tw.gov.invoice/files/.config/InvoiceApp.db3

Find out owner/group and SELlinux context for application data

/system/bin/ls -alZ /data/data/tw.gov.invoice/files/.config/

Update owner/group and SELinux context of the copied file to match existing files. Note that here u0_a261:u0_a261 and u:object_r:app_data_file:s0:c5,c257,c512,c768 are just examples. Actual values should be checked from the previous step. More details can be found in this article.
```
chown u0_a261:u0_a261 /data/data/tw.gov.invoice/files/.config/InvoiceApp.db3
chmod 0600 /data/data/tw.gov.invoice/files/.config/InvoiceApp.db3
/system/bin/chcon u:object_r:app_data_file:s0:c5,c257,c512,c768 /data/data/tw.gov.invoice/files/.config/InvoiceApp.db3
```

Linux 與 Windows 下顯示在螢幕最上層的時鐘

2021-07-13T00:00:00+08:00

最近跟老師開會，常常討論太久，超過老師應該要接小孩的時間。要怎麼避免類似的情況再發生呢？我覺得可以在用投影片報告的時候，螢幕上放一個顯眼的時鐘。

在 Linux 上，我平常使用的 devilspie2 能夠讓特定的視窗維持最上層顯示。例如，使用 xclock 時，可以在 $XDG_CONFIG_HOME/devilspie2/devilspie2.lua 加入以下內容：

if window_class_lower == 'xclock' then
    make_always_on_top()
end

這邊 window class 可以用 xprop 指令確認。設定好之後，xclock 就能顯示在 LibreOffice 上了。

而在 Windows 上，我找了幾個時鐘程式，都沒辦法顯示在 PowerPoint 投影片放映時顯示在最上層。後來有人提到對時工具 NTPClock 有這個功能。一試之下，終於成功！

2022-12-23 update

make_always_on_top() uses _NET_WM_STATE_ABOVE 1 2, so it needs xfwm4 >= 4.18 or another standard-violating window manager to make xclock appear above libreoffice slideshow.

一窺內容農場SEO技巧

2021-06-03T00:00:00+08:00

緣起

內容農場猖獗已久，近日尤甚。加上各個內容農場善用 SEO 技巧，使得使用 Google 搜尋時，不時能見到內容農場的文章。雖有終結內容農場等瀏覽器外掛，以及能搭配 uBlacklist 使用的 Google-Chinese-Results-Blocklist 等清單，終究是治標不治本。而近日在替 Google-Chinese-Results-Blocklist 編修清單時，發現了一個內容農場使用的 SEO 小技巧。聊表分享，以資雜談。

探究

luoow, jishuwen, weiwenku, mdeditor, gushiciku 等站都是我手動維護的一份內容農場清單中的項目。這幾個網域之間具有互相 HTTP 3xx 跳轉的關係。藉由Wayback Machine，可以看出網域的變遷。

jishuwen: 2020年九月底、十月初之間，由自行收錄文章，改為跳轉到 mdeditor。
luoow: 2021年五月上旬，由自行收錄文章改為跳轉到 gushiciku。
mdeditor: 2021年五月上旬，由自行收錄文章，改為跳轉到 gushiciku。
weiwenku: 先前是自行收錄文章，2021年四月底開始有跳轉到 luoow 的紀錄。

而藉由 WHOIS 資料，也可以一窺各個網域之間的連繫。其中一個網域註冊人為吴阳平，另一個網域的註冊人為 yangping wu。搜索這個名字會出現此 Facebook 帳號，其中註明了此人與其中一個網域微文庫的關聯，似乎是同一個人。

gushiciku WHOIS 資料

$ whois gushiciku.cn
Domain Name: gushiciku.cn
ROID: 20190517s10001s12057304-cn
Domain Status: ok
Registrant: 吴阳平
Registrant Contact Email: 185159865@qq.com
Sponsoring Registrar: 阿里云计算有限公司（万网）
Name Server: jill.ns.cloudflare.com
Name Server: dave.ns.cloudflare.com
Registration Time: 2019-05-17 10:45:36
Expiration Time: 2022-05-17 10:45:36
DNSSEC: unsigned

mdeditor WHOIS 資料

$ whois mdeditor.tw
Domain Name: mdeditor.tw
   Domain Status: ok
   Registrant:
      yangping wu  896500373@qq.com

   Administrative Contact:
      yangping wu  896500373@qq.com

   Technical Contact:
      yangping wu  896500373@qq.com

   Record expires on 2023-05-14 17:09:45 (UTC+8)
   Record created on 2020-05-14 17:09:45 (UTC+8)

   Domain servers in listed order:
      dave.ns.cloudflare.com
      jill.ns.cloudflare.com

Registration Service Provider: GoDaddy
Registration Service URL: http://www.GoDaddy.com/

Provided by NeuStar Registry Gateway Services

luoow WHOIS 資料

$ whois luoow.com
   Domain Name: LUOOW.COM
   Registry Domain ID: 2419015362_DOMAIN_COM-VRSN
   Registrar WHOIS Server: grs-whois.hichina.com
   Registrar URL: http://www.net.cn
   Updated Date: 2020-12-19T05:23:00Z
   Creation Date: 2019-08-01T10:34:54Z
   Registry Expiry Date: 2021-08-01T10:34:54Z
   Registrar: Alibaba Cloud Computing (Beijing) Co., Ltd.
   Registrar IANA ID: 420
   Registrar Abuse Contact Email: DomainAbuse@service.aliyun.com
   Registrar Abuse Contact Phone: +86.95187
   Domain Status: ok https://icann.org/epp#ok
   Name Server: DAVE.NS.CLOUDFLARE.COM
   Name Server: JILL.NS.CLOUDFLARE.COM
   DNSSEC: unsigned
   URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of whois database: 2021-06-03T16:00:00Z <<<

For more information on Whois status codes, please visit https://icann.org/epp

NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar.  Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

TERMS OF USE: You are not authorized to access or query our Whois
database through the use of electronic processes that are high-volume and
automated except as reasonably necessary to register domain names or
modify existing registrations; the Data in VeriSign Global Registry
Services' ("VeriSign") Whois database is provided by VeriSign for
information purposes only, and to assist persons in obtaining information
about or related to a domain name registration record. VeriSign does not
guarantee its accuracy. By submitting a Whois query, you agree to abide
by the following terms of use: You agree that you may use this Data only
for lawful purposes and that under no circumstances will you use this Data
to: (1) allow, enable, or otherwise support the transmission of mass
unsolicited, commercial advertising or solicitations via e-mail, telephone,
or facsimile; or (2) enable high volume, automated, electronic processes
that apply to VeriSign (or its computer systems). The compilation,
repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of VeriSign. You agree not to
use electronic processes that are automated and high-volume to access or
query the Whois database except as reasonably necessary to register
domain names or modify existing registrations. VeriSign reserves the right
to restrict your access to the Whois database in its sole discretion to ensure
operational stability.  VeriSign may restrict or terminate your access to the
Whois database for failure to abide by these terms of use. VeriSign
reserves the right to modify these terms at any time.

The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.
Domain Name: luoow.com
Registry Domain ID: 2419015362_DOMAIN_COM-VRSN
Registrar WHOIS Server: grs-whois.hichina.com
Registrar URL: http://whois.aliyun.com
Updated Date: 2020-07-08T12:42:47Z
Creation Date: 2019-08-01T10:34:54Z
Registrar Registration Expiration Date: 2021-08-01T10:34:54Z
Registrar: Alibaba Cloud Computing (Beijing) Co., Ltd.
Registrar IANA ID: 420
Reseller:
Domain Status: ok https://icann.org/epp#ok
Registrant City:
Registrant State/Province: Hu Nan
Registrant Country: CN
Registrant Email:https://whois.aliyun.com/whois/whoisForm
Registry Registrant ID: Not Available From Registry
Name Server: DNS11.HICHINA.COM
Name Server: DNS12.HICHINA.COM
DNSSEC: unsigned
Registrar Abuse Contact Email: DomainAbuse@service.aliyun.com
Registrar Abuse Contact Phone: +86.95187
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>>Last update of WHOIS database: 2021-06-03T16:00:22Z <<<

For more information on Whois status codes, please visit https://icann.org/epp

Important Reminder: Per ICANN 2013RAA`s request, Hichina has modified domain names`whois format of dot com/net/cc/tv, you could refer to section 1.4 posted by ICANN on http://www.icann.org/en/resources/registrars/raa/approved-with-specs-27jun13-en.htm#whois The data in this whois database is provided to you for information purposes only, that is, to assist you in obtaining information about or related to a domain name registration record. We make this information available "as is," and do not guarantee its accuracy. By submitting a whois query, you agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data to: (1)enable high volume, automated, electronic processes that stress or load this whois database system providing you this information; or (2) allow, enable, or otherwise support the transmission of mass unsolicited, commercial advertising or solicitations via direct mail, electronic mail, or by telephone.  The compilation, repackaging, dissemination or other use of this data is expressly prohibited without prior written consent from us. We reserve the right to modify these terms at any time. By submitting this query, you agree to abide by these terms.For complete domain details go to:http://whois.aliyun.com/whois/domain/hichina.com

gushiciku WHOIS 資料

$ whois jishuwen.com
   Domain Name: JISHUWEN.COM
   Registry Domain ID: 2313252870_DOMAIN_COM-VRSN
   Registrar WHOIS Server: grs-whois.hichina.com
   Registrar URL: http://www.net.cn
   Updated Date: 2020-09-17T01:35:51Z
   Creation Date: 2018-09-23T14:25:57Z
   Registry Expiry Date: 2021-09-23T14:25:57Z
   Registrar: Alibaba Cloud Computing (Beijing) Co., Ltd.
   Registrar IANA ID: 420
   Registrar Abuse Contact Email: DomainAbuse@service.aliyun.com
   Registrar Abuse Contact Phone: +86.95187
   Domain Status: ok https://icann.org/epp#ok
   Name Server: DAVE.NS.CLOUDFLARE.COM
   Name Server: JILL.NS.CLOUDFLARE.COM
   DNSSEC: unsigned
   URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of whois database: 2021-06-03T16:02:35Z <<<

For more information on Whois status codes, please visit https://icann.org/epp

NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar.  Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

TERMS OF USE: You are not authorized to access or query our Whois
database through the use of electronic processes that are high-volume and
automated except as reasonably necessary to register domain names or
modify existing registrations; the Data in VeriSign Global Registry
Services' ("VeriSign") Whois database is provided by VeriSign for
information purposes only, and to assist persons in obtaining information
about or related to a domain name registration record. VeriSign does not
guarantee its accuracy. By submitting a Whois query, you agree to abide
by the following terms of use: You agree that you may use this Data only
for lawful purposes and that under no circumstances will you use this Data
to: (1) allow, enable, or otherwise support the transmission of mass
unsolicited, commercial advertising or solicitations via e-mail, telephone,
or facsimile; or (2) enable high volume, automated, electronic processes
that apply to VeriSign (or its computer systems). The compilation,
repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of VeriSign. You agree not to
use electronic processes that are automated and high-volume to access or
query the Whois database except as reasonably necessary to register
domain names or modify existing registrations. VeriSign reserves the right
to restrict your access to the Whois database in its sole discretion to ensure
operational stability.  VeriSign may restrict or terminate your access to the
Whois database for failure to abide by these terms of use. VeriSign
reserves the right to modify these terms at any time.

The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.
Domain Name: jishuwen.com
Registry Domain ID: 2313252870_DOMAIN_COM-VRSN
Registrar WHOIS Server: grs-whois.hichina.com
Registrar URL: http://whois.aliyun.com
Updated Date: 2019-09-17T05:56:35Z
Creation Date: 2018-09-23T14:25:57Z
Registrar Registration Expiration Date: 2021-09-23T14:25:57Z
Registrar: Alibaba Cloud Computing (Beijing) Co., Ltd.
Registrar IANA ID: 420
Reseller:
Domain Status: ok https://icann.org/epp#ok
Registrant City:
Registrant State/Province: Hu Nan
Registrant Country: CN
Registrant Email:https://whois.aliyun.com/whois/whoisForm
Registry Registrant ID: Not Available From Registry
Name Server: DAVE.NS.CLOUDFLARE.COM
Name Server: JILL.NS.CLOUDFLARE.COM
DNSSEC: unsigned
Registrar Abuse Contact Email: DomainAbuse@service.aliyun.com
Registrar Abuse Contact Phone: +86.95187
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>>Last update of WHOIS database: 2021-06-03T16:02:53Z <<<

For more information on Whois status codes, please visit https://icann.org/epp

Important Reminder: Per ICANN 2013RAA`s request, Hichina has modified domain names`whois format of dot com/net/cc/tv, you could refer to section 1.4 posted by ICANN on http://www.icann.org/en/resources/registrars/raa/approved-with-specs-27jun13-en.htm#whois The data in this whois database is provided to you for information purposes only, that is, to assist you in obtaining information about or related to a domain name registration record. We make this information available "as is," and do not guarantee its accuracy. By submitting a whois query, you agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data to: (1)enable high volume, automated, electronic processes that stress or load this whois database system providing you this information; or (2) allow, enable, or otherwise support the transmission of mass unsolicited, commercial advertising or solicitations via direct mail, electronic mail, or by telephone.  The compilation, repackaging, dissemination or other use of this data is expressly prohibited without prior written consent from us. We reserve the right to modify these terms at any time. By submitting this query, you agree to abide by these terms.For complete domain details go to:http://whois.aliyun.com/whois/domain/hichina.com

我猜搜尋引擎對網站的排名會隨著 HTTP 3xx 跳轉而轉移。藉由 3xx 跳轉不斷變換網域，能在保留網域排名的情況下不斷規避封鎖清單。或許未來封鎖清單能自動追蹤網域跳轉，在新網域獲得足夠的排名前先行封鎖。

無論如何，瀏覽器外掛終究需要使用人數多才能發揮效益。這應是過於樂觀了──當這種情況成真時，或許多數人已經了解抵制內容農場的重要性，內容農場的消亡也不遠了。

[轉載] Containers 系統架構

2021-03-23T00:00:00+08:00

Rootless containers 是一項最近還滿常被討論的技術。比較常見的實作當推 RedHat 主打的 Podman。在學習 Podman 的過程中，被 container 架構的複雜性搞的七葷八素。查遍各處，寫的比較完善的中文解說莫屬第 11 屆 iT 邦幫忙鐵人賽參賽作品：其實我真的沒想過在美國上班也被拉來參加30天分享那些年我怎麼理解 kubernetes 的運作。這一系列的文章分門別類講述 container stack 中的不同元件，再輔以歷史的脈絡探討架構演變的過程中，主事者可能的心路歷程。詳盡而不流於雜亂，且能看出作者的技術功力深厚，個人認為是上乘之作！

Migrate Android data from an F-Droid app to a Google Play one

2021-03-15T00:00:00+08:00

Motivatation

Recently, login for TTRSS-Reader is broken after a server update. A working version is uploaded to Google Play, but it presumably takes a long time for the F-Droid version to be updated. I investigated how to migrate data between Android apps as I cannot live without RSS feeds for one day :D

Migration

Clear cache and force stop the application

Backup data

htc_ocndugl:/data/data/org.ttrssreader # tar zcvf /data/local/tmp/org.ttrssreader.tar.gz *

Uninstall the current version (from F-Droid) and install the other version (from Google Play)

Find out the new UID and SELinux context

htc_ocndugl:/data/data/org.ttrssreader # ls -lZ
total 28
drwxrws--x   2 u0_a270 u0_a270_cache u:object_r:app_data_file:s0:c14,c257,c512,c768  4096 2021-03-15 12:28 cache
drwxrws--x   2 u0_a270 u0_a270_cache u:object_r:app_data_file:s0:c14,c257,c512,c768  4096 2021-03-15 12:28 code_cache

The new uid is u0_a270 (10270) and the new SELinux label is u:object_r:app_data_file:s0:c14,c257,c512,c768.

Restore data

htc_ocndugl:/data/data/org.ttrssreader # tar --exclude=cache --exclude=code_cache -zxvf /data/local/tmp/org.ttrssreader.tar.gz

Change UID and SELinux context

htc_ocndugl:/data/data/org.ttrssreader # chown 10270 .
htc_ocndugl:/data/data/org.ttrssreader # chgrp 10270 .
htc_ocndugl:/data/data/org.ttrssreader # chown -R 10270 app_textures/ app_webview/ databases/ files/ shared_prefs/
htc_ocndugl:/data/data/org.ttrssreader # chgrp -R 10270 app_textures/ app_webview/ databases/ files/ shared_prefs/
htc_ocndugl:/data/data/org.ttrssreader # chcon -R -h u:object_r:app_data_file:s0:c14,c257,c512,c768 app_textures/ app_webview/ databases/ files/ shared_prefs/

Here, the c14,c257,c512,c768 part in a SELinux label is new to me. Reading SELinux documents and tutorials, they seem "categories" for multi-category security (MCS). Few materials discuss how categories are assigned in Android. Here are some references:

SELinux concepts mentions that categories are used to "Isolate the app data from access by another app" and "Isolate the app data from one physical user to another." I guess categories plays a similar role to UIDs like u0_a270 in the DAC world.
Security Enhancements for Android mentions a levelFrom= parameter.
Furthermore, SELinux policies for fine-grained protection of Android apps mentions the relation between levelFrom= and category numbers. Those numbers do not match what I got from ls -Z exactly but close. Probably actual category numbers are related on them.

SELinux adoption in Android makes things complicated as well as interesting!

What's inside a backup file of IPMIView on Android?

2021-03-07T00:00:00+08:00

IPMIView is a handy tool to monitor status of multiple servers at once. It provides a backup feature to export settings and credentials. Per file and bsdtar commands, the backup file /sdcard/Supermicro/IPMIViewBackup_YYYYMMDDHHMMSS.smc is a password-protected zip archive. Assuming the password can be extracted from the APK, I started a journey of reverse engineering.

First, retrieve the APK file for IPMIView:

$ adb shell pm list packages | grep -i ipmi
package:com.smc.smcipmitool
$ adb shell pm path com.smc.smcipmitool
package:/data/app/com.smc.smcipmitool-MffdfTl97aivo2O1HplX2g==/base.apk
$ adb pull "/data/app/com.smc.smcipmitool-MffdfTl97aivo2O1HplX2g==/base.apk"
$ mv base.apk com.smc.smcipmitool.apk

And let apktool extract smali codes:

$ apktool d com.smc.smcipmitool.apk

Next, find out which classes are related to the backup file:

$ rg -l IPMIViewBackup com.smc.smcipmitool
com.smc.smcipmitool/smali/com/smc/smcipmitool/util/IPMIBackUpAgent$3.smali
com.smc.smcipmitool/smali/com/smc/smcipmitool/util/IPMIBackUpAgent.smali
com.smc.smcipmitool/smali/com/smc/smcipmitool/util/IPMIBackUpAgent$1.smali

Finally, searching for 'password' in these files. Bingo! In com.smc.smcipmitool/smali/com/smc/smcipmitool/util/IPMIBackUpAgent$1.smali, there is a function call:

move-result-object v1

const-string v2, "8o2r2c6i5M9r9e0puS"

invoke-virtual {v1, v5, v3, v2}, Lcom/smc/smcipmitool/util/IPMIBackUpAgentHelper;->zipDirWithPassword([Ljava/io/File;Ljava/io/File;Ljava/lang/String;)Z

So, the password is here. I can use that password to extract the compressed IPMIViewBackup.smc

$ bsdtar -xf IPMIViewBackup_YYYYMMDDHHMMSS.smc IPMIViewBackup.smc

It's yet another zip archive.

$ bsdtar tf IPMIViewBackup.smc
group.xml
shared_prefs/
shared_prefs/session_pref.xml
shared_prefs/com.smc.smcipmitool_preferences.xml

IPMI server IPs, encoded usernames and passwords can be found in the file group.xml.

Elementary, My Dear Watson. - not by Sherlock Holmes

Removal from HSTS preload list for my domain

2020-11-08T14:24:00+08:00

Motivation

Since long time ago, I host my website on my own server. As time goes by, the maintaining cost for this website appears to increase indefinitely with complexity from Podman, Ansible, Buildbot and so on. I have once tried use GitLab pages to host my website. However, it does not support adding custom HSTS headers, so I need to opt-out HSTS preloading if I don't want to see a warning on hstspreload.org.

Timeline

Opting-out HSTS preloading is as simple as opting-in. I just changed the Strict-Transport-Security header for my server and submit a request at hstspreload.org. As it is said that the removal can take a long time, I'm curious how long it will. So, here is the timeline.

2020/11/08 submitted removal request
2020/11/14 Removed from Chromium source
2020/11/17 Removed from Firefox source

Use ECDSA certificate for identification on IRC networks

2020-10-17T15:56:00+08:00

Motivation

Recently, I noticed that I can no longer make myself as an operator on the OFTC channel #lxqt. It turns out that my current SSL client certificate has expired a few days ago. As it seems that there is no way to extend expiry of an X509 certificate like what we can do for PGP keys, I need to regenerate a client certificate.

Meanwhile, I heard that ECDSA certificates are much smaller than RSA certificates, resulting in faster TLS handshakes. Although IRC uses persistent connections, so the performance improvement during handshakes does not matter much, it sounds really cool. So here is my journey - switching to ECDSA certificates on IRC networks.

Steps

The first step is generating a pair of ECDSA key and certificate. I use this one line command

$ openssl req -nodes -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -keyout irc_client_key.pem -x509 -days 3650 -out irc_client_cert.pem

Following steps for ECDSA certificates are the same as those for RSA certificates. I follow instructions from OFTC to create a combined key/certificate file and get its SHA1 fingerprint.

$ cat irc_client_key.pem >> irc_client_cert.pem
$ chmod 400 irc_client_cert.pem
$ openssl x509 -noout -fingerprint -text < irc_client_cert.pem

Steps for libera.chat are similar, except that a SHA512 fingerprint is needed.

$ openssl x509 -noout -fingerprint -sha512 < irc_client_cert.pem

Later I need to tell IRC servers about my new fingerprint. As the certificate has expired, I need to identify myself with a password first.

/msg NickServ identify not_my_real_password

And then actually add the new fingerprint.

/msg NickServ cert add new_fingerprint_without_colons

After re-connecting to the IRC server to make sure the new certificate really works, the old fingerprint can be removed.

/msg NickServ cert del old_fingerprint_without_colons

Now I can make myself as an operator 🎉

/msg ChanServ op #lxqt yan12125

After doing whatever channel management work, remove myself as an operator as usual.

/msg ChanServ deop #lxqt yan12125

Using WireGuard kernel module for HTC U11

2020-02-02T00:00:00+08:00

Background

Recently, there are plenty of introductory articles about the WireGuard VPN on Phoronix as the first stable Linux kernel with WireGuard (5.6) is released. At first I thought it was nothing but yet another VPN protocol like conventional PPTP or L2TP. However, after digging into it, I found that it is different by design. It is quite simple. WireGuard tools only create the VPN by adding a network interface and assign the IP and the gateway. There is neither NAT nor DHCP. So, I decided to give it a try.

Using WireGuard on Android

A first taste

The official App already includes a Go backend, so enabling WireGuard on Android is as simple as installing an application and deploying an configuration file. However, there are some limitations with the default Go backend. It utilizes Android's VPN framework to tunnel traffic. As a result, there is always a VPN icon in the notification area, and I cannot connect to another VPN while keeping the WireGuard VPN connected. For phones with root access, a solution is using the Linux kernel module backend, so that limitations imposed by Android frameworks are gone.

Building the kernel module

zx2c4's article on XDA includes descriptions for how to build the WireGuard kernel module for Android devices. That post mentioned the android_kernel_wireguard repo, which is apparently an AOSP project as there is a top-level Android.mk file. As per patch_kernel.sh in that AOSP repo, I need to inject wireguard-linux-compat into the kernel source tree for my device as an in-kernel module. After the injection, I can build the whole kernel to get the WireGuard kernel module. To simplify things, I decided to try out building a vanilla kernel image first.

Building a vanilla kernel

Fortunately, HTC obeys GPL obligations and makes source code tarballs for kernels used on devices available on htcdev.com. First, let's download and extract kernel sources provided by HTC.

$ curl 'http://dl4.htc.com/RomCode/Source_and_Binaries/ocndtwl-4.4.153-perf-g0041d80.tar.gz' -H 'Referer: https://www.htcdev.com/devcenter/downloads' -O
$ tar xf ocndtwl-4.4.153-perf-g0041d80.tar.gz

Among extracted files, there is a Readme.txt with build instructions. Basically, I should be able to build the whole kernel by following those instructions. However, there are two tricks. First, the kernel is built with GCC, while Android NDK has phased out GCC. As a result, the latest revision of https://android.googlesource.com/platform/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9 contains only binutils but not GCC. To work around the issue, I used an older branch for the compiler repo. Second, the kernel provided by HTC is too old, so that host scripts cannot be compiled with GCC 10 or newer as the latter forbids common symbols from different source files. Thanks to the hint given by Nathan Chancellor, I can apply a simple patch to make things build. Here are all steps:

$ mkdir kernel
$ tar xf ocndtwl-4.4.153-perf-g0041d80.tar.gz
$ git clone https://android.googlesource.com/platform/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9 -b ndk-r13-release --depth 1
$ cd kernel
$ mkdir -p out
$ curl "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/patch/?id=ce513359d8507123e63f34b56e67ad558074be22" > gcc10.patch
$ patch -Np1 -i gcc10.patch
$ make ARCH=arm64 CROSS_COMPILE="$PWD"/../aarch64-linux-android-4.9/bin/aarch64-linux-android- O=out htcperf_defconfig
$ make ARCH=arm64 CROSS_COMPILE="$PWD"/../aarch64-linux-android-4.9/bin/aarch64-linux-android- O=out -j3

Build the WireGuard module with the vanilla kernel

After building the kernel, I started to integrate steps for building my kernel module into the scripts for building WireGuard kernel modules. By some googling, I found https://github.com/WireGuard/android-wireguard-module-builder, which contains scripts for building hosted kernel modules on the download server used by the WireGuard Android application. In that repository, build-one.bash uses repo to build the kernel module using do.bash and manifest.xml in kernels/<codename>. Here manifest.xml is an AOSP platform manifest just like those mentioned on official build instructions for Android kernels. In existing scripts, do.bash calls build.sh in the AOSP kernel/build project. However, as HTC provides only tarballs instead of a complete AOSP tree, I decided to put all commands, include injecting the wireguard-linux-compat module into the kernel source tree and building the whole kernel, directly into do.bash. I still need a git repository as AOSP manifest.xml does not seem to accept tarballs. By some googling, I found the maintainer behind the TWRP port for my device publishes a git repo with mostly the same files as downloaded from htcdev.com. After some trials, I managed to create manifest.xml that specifies an older branch of the compiler repo and use a non-Google git repository. The overall results are submitted as a pull request and it got merged. Now I can reproduce the kernel module with a simple step:

$ ./build-one.sh ocn

A few months later, I was hit by the GCC 10 issue mentioned above, so I created another pull request to get it fixed.

Deploy the built kernel module

The kernel module built by scripts mentioned above has a hash string in its name. That hash can be computed by running sha256sum /proc/version|cut -d ' ' -f 1 on the device as hinted on the module-builder repo. Moreover, if the kernel module exists in the download path used by the Android application, it will load that module as if the latter is downloaded from the official download server. Above all, I can place the locally-built kernel module to where the application expected, and click in the Android application to use the module:

$ adb push out/wireguard-80ee34126cd97c9a15bc3b970a6f38ce30852d0b8547dbcc43eee22956aa1934.ko /data/local/tmp/
$ adb shell
$ su
$ cd /data/data/com.wireguard.android/cache
$ mkdir -p kmod
$ cp /data/local/tmp/wireguard-80ee34126cd97c9a15bc3b970a6f38ce30852d0b8547dbcc43eee22956aa1934.ko kmod/

After my pull request is merged, the kernel module for my device appeared on the official download server. To verify it, I cleared the application cache and then click the "Download and install kernel module" again without pushing the locally-built module beforehand. Confirmed working!

Random feelings

It is not my first time to build a Android kernel, but it is my first time to interact with professional Android kernel developers for such a bleeding-edge and exciting feature. I learned a lot, and I am looking forward to contributing more to AOSP!

Migrating Windows 10 from VirtualBox to LibVirt

2020-01-16T22:50:00+08:00

Motivation

I'd like to run Android emulators on my PC for unit tests of python3-android. However, Android emulators failed to run as the same host already runs a Windows VM using VirtualBox, and VirtualBox VMs cannot run together with KVM-based ones like recent Android system images for x86/x86_64. Thinking twice, I decided to move away from VirtualBox and try out LibVirt, which uses qemu under the hood and is comaptible with Android emulators.

Steps

Mostly I follow a Chinese blog post. A tricky point is about permissions. libvirtd, the daemon for LibVirt, uses PolicyKit to restrict connections to authenticated users only. Either I need to add myself to the libvirt group as described in the aforementioned blog post, or I need to enter my password whenever I want to connect to LibVirt. In the end, I found that the remote-viewer command from the virt-viewer package allows connecting to virtual machines without bothering with authentication. As I seldom modify settings of virtual machines, I didn't add myself to the libvirt group, following the principle of least priviledge.

Performance tuning

Like VirtualBox, default configuration in a LibVirt VM provides hardware simulation that can boot Windows without extra steps, while the performance is awful, especially for disk I/O and graphics. To get better performance, I set up VirtIO to enjoy the benefit of paravirtualization.

Enabling VirtIO-backed disks

This is somehow tricky as Windows does not seem to install the virtio driver for the disk controller if I boot the VM with the default disk controller, and if I switch to the VirtIO-based disk controller, Windows does not boot, showing an error INACCESSIBLE BOOT DEVICE. In the end, I install the driver for the disk controller in the Windows Recovery Environment (Windows RE). First, mount the VirtIO ISO to the VM before booting. During boot, hit F8 repeatedly until Windows RE is reached. In a command prompt, I first install the VirtIO driver to the running Windows RE system (assuming the VirtIO ISO is mounted on D:\),

C:\>drvload D:\viostor\w10\amd64\viostor.inf

And then I can reach my Windows installation on the VirtIO-based disk and install the driver into the normal system (assuming mounted on E:\),

C:\>dism /image:E: /add-driver /driver:D:\viostor\w10\amd64\viostor.inf`

Other hardware components, including the QXL graphics controller and the VirtIO ethernet adapter, are much easier to setup as they can be configured with GUI tools on a running Windows instance.

CPU usage tuning

Another performance issue I noticed is that CPU utilization of the qemu process is quite high when VM is idle. I remember the value is < 10% for a VirtualBox VM. Google brings me to a Reddit post, and after disabling HPET, the CPU usage went down to the normal range.

UPDATE

After some time I noticed that the CPU usage of the qemu process is quite high again. It often goes beyond 50%. Using the perf command mentioned by /u/tholin in the Reddit post above, I found that the vmx_l1d_flush function takes some time.

$ sudo perf kvm --host top -p `pidof qemu-system-x86_64`
4.84%  [kernel]                    [k] vmx_l1d_flush
3.33%  [kernel]                    [k] __fget_files
2.75%  [kernel]                    [k] native_write_msr
2.62%  [kernel]                    [k] do_sys_poll
2.30%  [kernel]                    [k] _raw_spin_lock_irqsave

The function with the highest overhead vmx_l1d_flush seems to be related to L1TF. From kernel source codes, this function is controlled by a module kernel parameter vmentry_l1d_flush. From this Ubuntu wiki page, it can be disabled by the following command:

$ echo never | sudo tee /sys/module/kvm_intel/parameters/vmentry_l1d_flush

After shutting down the VM, setting the module parameter and restarting the VM, CPU usage of the qemu process goes back to under 10% most of time. As it is a security mitigation, I'll reverted to the default and keep it until I observed real performance bottlenecks.

Shared folder performance

I used the shared folders feature of VirtualBox to allow virtual machines to access files on the host. The equivalent feature in LibVirt seems VirtIO-FS, while it requires the WinFSP kernel module, and I had some issues using SSHFS-Win with WinFSP. Instead, I choose to deploy a Samba server on the host. A performance bottleneck I noticed is that when the first Office file is opened after booting, there is a long delay with several seconds. Using WireShark, I found connection attemps to port 80 from the VM to the host using User-Agent: DavClnt, and there is already a blog post about it. It seems the WebClient service is still started if I set its startup type to manual, so I disable the service altogether, and there is no longer delay when files are opened.

Memories about VirtualBox

My experience with VirtualBox was great. I had used it on Windows, macOS and Linux, and there are only minor hiccups. Host kernel modules for VirtualBox is out of tree, and thus upgrading the kernel requires additional care. VirtualBox guest additions follow the same release schedule as the main VirtualBox program. As a result there were often Windows notifications about upgrading it. Furthermore, the extension pack for VirtualBox is not open source, and I need to manually package it often. With LibVirt and qemu, those minor issues are gone as KVM is built into the kernel, VirtIO Windows drivers are not updated often, and the open source version of LibVirt is already feature complete for me. To me, LibVirt is not substantially better, but I guess I will not go back to VirtualBox :)

A workaround for CCStudio 9.2 UI issue - black backgrounds in tooltips

2019-12-01T12:54:00+08:00

CCStudio is what our lab use for developing software on TI MSP430 board. Recently, version 9.2.0 of CCStudio is out, and I noticed that its UI now uses GTK+3 instead of GTK+2. In general this is a good change as GTK+3 has a better look-and-feel by default than GTK+2. However, soon I noticed an issue. Tooltips, which appear when you hover around functions or variables in the code editor, have black backgrounds. As texts in tooltips are also black or in similar colors, tooltips are not readable.

I wonder if this is an incompatibility with CCStudio and GTK+3. First I tried uninstalling gtk3 from my system. Yes the UI goes back to GTK+2 and tooltips are readable again. Obviously it is not a long-term fix as several other software like Firefox need it. I took some time to study how CCStudio selects between GTK+2 and GTK+3. First I looked at files loaded by the ccstudio process via lsof. There are some *gtk*.so files, and libswt-pi-gtk-4880.so, which is from Eclipse SWT, seems the most relevant. The source code of SWT can be found here. As the SWT version used in CCStudio is 3.107.0.v20180611-0422, I picked git tag I20180611-0500 and searched for the configuration key for the GTK+ version in this repository. After some code reading, I found that an environment variable SWT_GTK3 controls whether SWT prefers GTK+3 or GTK+2.

So, a long-term fix is simple - starting CCStudio with SWT_GTK3=0.

Update 2020/01/08 - the issue appears to be fixed in CCStudio 9.3.

「臺灣學術網路網路語音交換平臺」憑證錯誤的問題

2019-11-22T11:00:00+08:00

臺灣學術網路網路語音交換平臺是一個提供 ZOOM 服務的平臺。用 eduroam 帳號登入並登記，就可以三人以上使用 ZOOM 超過 40 分鐘。LAB 遠端 meeting 滿常用這個平台。

前幾週這個平臺的入口網站憑證過期了。留言反應後他們很快就換上新的憑證。但新的憑證有個問題：缺乏 intermediate CA 的憑證，導致 Firefox 無法連線。我再次留言反應，得到的回覆是他們用 Firefox、Chrome 等等各大瀏覽器都能連線，請我確認我的 Firefox 是否有問題。的確，新安裝的 Chrome，也能正確處理缺乏 intermediate CA 的問題，那為何 Firefox 不行呢？

查了一下，有個功能叫做 AIA fetching ，也有人叫他 AIA chasing ( 例如此Python ticket )，可以解決缺乏 intermediate CA 的問題。看起來這功能是從憑證的「授權資訊存取」( Authority Information Access, AIA ) 這個欄位取得憑證簽發者，也就是 intermediate CA 的憑證。平臺網站用的憑證是有AIA這個欄位的，然而 Firefox 並不打算支援 AIA ，目前只好自立更生，利用 Firefox 會快取 intermediate CA 憑證的特性，先訪問一個和這個平台網站有相同 intermediate CA ("政府伺服器數位憑證管理中心 - G1") 的網站 ( 例如：桃園市政府財產管理系統 )，來讓缺乏 intermediate CA 的憑證可以通過驗證。

What are public_key fields in GitHub gpg_keys API?

2019-08-29T20:00:00+08:00

GitHub provides an API endpoint for querying users' PGP keys. For example, information about my keys can be found here.

In this JSON document, the raw_key is what programs like GnuPG need. What about public_key fields? GitHub official document says:

The data returned in the public_key response field is not a GPG formatted key. When a user uploads a GPG key, it is parsed and the cryptographic public key is extracted and stored. This cryptographic key is what is returned by the APIs on this page. This key is not suitable to be used directly by programs like GPG.

With the help of the gpgpdump tool, I found that contents in public_key fields are actually base64-encoded OpenPGP packets, which are defined in RFC 4880.

$ curl -s https://api.github.com/users/yan12125/gpg_keys | jq -r '.[0].public_key' | base64 -d | ./gpgpdump
Public-Key Packet (tag 6) (1198 bytes)
        Version: 4 (current)
        Public key creation time: 2016-04-06T02:36:01+08:00
                57 04 05 91
        Public-key Algorithm: DSA (Digital Signature Algorithm) (pub 17)
        DSA p (3072 bits)
        DSA q (q is a prime divisor of p-1) (256 bits)
        DSA g (3070 bits)
        DSA y (= g^x mod p where x is secret) (3069 bits)

As an OpenPGP key is composed of a series of OpenPGP packets, it is theoretically possible to reconstruct a key for verifying stuffs. To achieve that, an extra user ID packet and a GnuPG patch are needed. The following Python 3 script can be used to generate a user ID packet:

TAG_UID = 13

uid = 'foo@example.com'
# RFC 4880, Sec 4.2.1.  Old Format Packet Lengths
header = bytes([0x80 | (TAG_UID << 2), len(uid)])
packet = header + uid.encode('ascii')

sys.stdout.buffer.write(packet)

And the following GnuPG patch forces verification even if there are no signatures.

diff --git a/g10/sig-check.c b/g10/sig-check.c
index 4c172d692..eb4653535 100644
--- a/g10/sig-check.c
+++ b/g10/sig-check.c
@@ -177,7 +177,7 @@ check_signature2 (ctrl_t ctrl,
                  gnupg_compliance_option_string (opt.compliance));
       rc = gpg_error (GPG_ERR_PUBKEY_ALGO);
     }
-  else if (!pk->flags.valid)
+  else if (0)
     {
       /* You cannot have a good sig from an invalid key.  */
       rc = gpg_error (GPG_ERR_BAD_PUBKEY);

In practice, no self-signatures simply means the key cannot be trusted. So this is just a fun experiment :)

P.S. I've also posted similar contents to https://stackoverflow.com/a/57712714/3786245.

GnuTLS無法連上部分台灣網站的問題

2018-09-23T18:52:00+08:00

TL;DR - 請看最後一段的workaround。

今天台大計中的SSLVPN client pulse-secure升級到9.0r2.0了，我更新完之後測了一下，發現連登入的頁面都連不上

"Unacceptable TLS certificate"

於是開始了一番debug...

由於這個錯誤訊息在pulse-secure的檔案裡沒有，因此懷疑是WebKitGTK的問題。用ceiba-dl測了一下，果然是這樣。

把source code們拿出來探究一番，從WebKitGTK，libsoup，glib-networking，最後到GnuTLS和p11-kit...

經過追查，確認是當年TWCA提交給Mozilla的證書有問題，而GnuTLS檢查過於嚴格，才導致連線失敗。

(詳細技術內容可參考我回報給GnuTLS的issue)

這次感想有兩點：

第一次看到一個certificate chain裡的intermediate CA同時也是個root CA的，腦筋有點轉不太過來
台灣廠商不EY(?)

Workaround很簡單，把TWCA Global Root CA從mozilla.trust.p11-kit這個檔案移除，再跑一遍sudo trust extract-compat就好了。

犀利仁師觀後雜感

2018-08-05T20:38:00+08:00

前陣子整理我的歌曲收藏。其中一首「不能說出口的諾言」沒什麼印象是從那邊聽到的。一查之下是2014年的電視劇犀利仁師。

這幾天找了些時間在YouTube把犀利仁師44集都看完了。裡面我印象最深刻的角色是宋文文，最讓我牽腸掛肚的也是宋文文和范大同一波三折的愛情。這應該是我看過這麼多電視劇以來，唯一對配角的印象比主角還深刻的。

范大同一開始還以為自己有斷袖之癖，後來發現真相才釋懷。這讓我想到花千骨小說裡的軒轅朗，和女扮男裝的花千骨也有類似情節。不過後者不是主線劇情，作者沒有多加著墨，我就沒有特別感觸了。

這齣戲有兩個地方讓我哭出來。一個是演完梁祝的時候。戲本身還好，但是看到大家都在哭就很想哭。第二個是柳傲天被打80大板的時候。聽說4 50下就被打死的不少，打80大板實在太慘了...

有個小點想吐槽。宋文文歷經杖刑，恢復女子之身後，穿的是和慕容月一樣風格的大家閨秀，讓我感覺很違和。依宋文文的性格，感覺路先生那種路線的服裝會比較適合點。

而看完一長串的電視劇，都會有的後遺症這次也沒少。這幾天看到鬼鬼的照片腦海理都會浮現宋文文的男裝形象。在想事情的時候，「不行」也會變成帶尾音的北京腔XD

解決macOS分享的Wi-Fi使Line Points無法使用的問題

2018-07-07T01:18:00+08:00

Line Points的頁面用Linux hostapd分享出來的Wi-Fi可以正常運作，然而用macOS的網路分享功能無法瀏覽。這個問題困擾了我好久。之前要開Line Points都是先切換成4G，等到要下載App或看影片再換回Wi-Fi。

某天在PTT上看到有人Wi-Fi環境下用Line無法上傳圖片。鄉民建議改MTU。我參考這篇找出最佳MTU值，套用上去之後，macOS分享的Wi-Fi也可以正常使用Line Points了。解決了一個延宕多時的問題，何其暢快！

PS. 何其XX是港劇公主嫁到中男主角金多祿的口頭禪之一。

macOS上df無法正確顯示中文

2018-06-23T22:29:00+08:00

最近心血來潮，把工作環境設定為中文。在Linux下是開一個檔案~/.config/locale.conf，寫入LANG=zh_TW.UTF-8。macOS下，iTerm2會自動設定LANG和LC_CTYPE這兩個環境變數。

第一個出現問題的是zsh下，ssh的hostname自動完成。按下tab後，游標會自動往前一格。目前還沒查出問題來。

第二個問題是macOS下的df中文顯示錯亂。由於GNU coreutils整體上比mac內建的指令好用，因此我長久以來都是用MacPorts安裝的coreutils。

今天環境改成中文時，df出現怪異的輸出：

�?�?系統 容�?? 已�?� �?��?� 已�?�% �??�?�?
/dev/disk1s1    234G  151G    81G    65% /
/dev/disk1s4    234G  2.1G    81G     3% /private/var/vm

這串文字丟進python encode後的結果是：

b'\xe6\xaa?\xe6\xa1?\xe7\xb3\xbb\xe7\xb5\xb1 \xe5\xae\xb9\xe9?? \xe5\xb7\xb2\xe7?\xa8 \xe5?\xaf\xe7?\xa8 \xe5\xb7\xb2\xe7?\xa8% \xe6??\xe8\xbc?\xe9\xbb?'

正確版本應該是：

b'\xe6\xaa\x94\xe6\xa1\x88\xe7\xb3\xbb\xe7\xb5\xb1 \xe5\xae\xb9\xe9\x87\x8f \xe5\xb7\xb2\xe7\x94\xa8 \xe5\x8f\xaf\xe7\x94\xa8 \xe5\xb7\xb2\xe7\x94\xa8% \xe6\x8e\x9b\xe8\xbc\x89\xe9\xbb\x9e'

可以看出，某些byte被換成問號了。

Google了一番，沒啥結果。決定自行把coreutils抓下來compile，再丟到lldb debug。一番努力之後，發現df的hide_problematic_chars()會把iscntrl()回傳1的字元換成問號。這個函數在Linux上是正常的，但在mac上，卻會受到locale影響。我寫了一個小程式測試：

#include <locale.h>
#include <stdio.h>
#include <ctype.h>

int main()
{
    printf("%d\n", iscntrl(148));
    setlocale(LC_ALL, "");
    printf("%d\n", iscntrl(148));
    return 0;
}

在Linux上，輸出0 0，而在mac上輸出0 1。

目前先自行編一個hide_problematic_chars()改過的版本將就用著，等有空再向GNU提bug。

2020/11/08更新：

向coreutils提交了一份bug report，接著我的patch被修改後commit到coreutils了！
zsh中ssh tab補全似乎已經修好了。

網站搬家

2018-06-01T11:59:00+08:00

今天收到Let's Encrypt的通知信，說chyen.cc和*.chyen.cc的SSL憑證20天後過期。我這個網域名稱是在Namesilo買的。由於Let's Encrypt的wildcard certificate需要用DNS認證，然而certbot還不支援Namesilo，所以我上次是手動把TXT紀錄一個一個(註：每個domain name會對應一個DNS challenge)填上去。這次決定把DNS改由CloudFlare代管，用certbot的dns-cloudflare外掛直接取得新的SSL憑證。

會選CloudFlare一個原因是我有考慮未來我的Arch Linux個人repo可能會需要開CDN，先把DNS搬過去之後就省的再搬。

CloudFlare的教學我是參考香腸大的文章，基本上設定滿簡單易懂的，新增DNS record後，propagate的時間也很短，大約幾秒到幾十秒而已，比Namesilo弄每個record都讓我等了好幾分鐘好多了。一個小小的缺點是，CloudFlare設定兩階段驗證只給QR code，不提供直接給TOTP secret的選項。為了把TOTP存進KeePassXC資料庫中，只好用zbar把QR code還原回TOTP URI。

接著用certbot請求一個新的SSL憑證。第一次遇到" The currently selected ACME CA endpoint does not support issuing wildcard certificates."的錯誤。原來是因為技術問題，certbot到現在還沒預設為ACMEv2。這讓我想起了當初ACMEv2因為安全性問題延後發布。ACMEv2還真是命運多舛啊！

發好新憑證之後，順便把一些原本跑在chyen.csie.org的服務改到chyen.cc上。

第一個是Quassel IRC server。把新憑證複製過去，Quassel重新啟動就完成了，沒遇到什麼問題。

接下來是Postfix mail server。我把main.cf改好，去Nextcloud, BuildBot, TT-RSS等地方把寄件者的domain name改成新的，以為這樣就完工了，實際測試寄信的時候卻跳出cannot connect的錯誤。這時我才想起我防火牆沒開Postfix，因此需要到/etc/hosts把"127.0.0.1 chyen.cc"加進去。

這時候，寄信到gmail沒問題，寄到hotmail卻被當成垃圾信。查了一下發現DNS反解忘了改。到Linode把DNS反解也改成新的網址之後，hotmail還是不認我的信。目前可能只能先用白名單擋著了。

最後是這個部落格。改一下pelican跟Apache的設定檔就好。也順便加上了RSS feed並把預設template裡面沒用的指令刪掉。

搞這些花了我一個晚上。運維真的是件頗麻煩的工作XD

在Firefox 59上使用郵局的WebATM

2018-03-27T20:13:00+08:00

安裝郵局提供給Firefox/Chrome/Edge用的元件
啟動元件
匯入根憑證cacert.pem

進階玩法：VirtualBox NAT port forwarding

小小抱怨：WebATM元件一開機就會啟動，也不能取消，微不便

解決scrcpy crash的問題

2018-03-27T20:10:00+08:00

之前聽說scrcpy可以把Android的螢幕同步到電腦上。第一次裝沒跑成功，crash了。

經過一番測試，發現似乎SDL(scrcpy用的GUI library)會嘗試載入ibus，而強制指定export SDL_IM_MODULE=fcitx後可以正常執行scrcpy。正當準備提bug時，Arch Linux的sdl2來了一份更新，此後不需要SDL_IM_MODULE也不會crash了。

不知是否相關？聊表紀錄。

Firefox Sync無法同步的問題

2018-03-16T21:17:00+08:00

TL;DR security.nocertdb設定為true會讓Firefox Sync無法運作，改回false即可

最近發現我的Firefox Sync無法正常運作，在一台電腦上新加的addon沒有同步到其他電腦上。

about:sync-log中的紀錄檔有以下錯誤訊息：

1520939110858   Sync.Service    INFO    User logged in successfully - verifying login.
1520939110862   Sync.BrowserIDManager   DEBUG   unlockAndVerifyAuthState: user declined to unlock master-password
1520939110862   Sync.Status DEBUG   Status.login: success.login => service.master_password_locked
1520939110862   Sync.Status DEBUG   Status.service: success.status_ok => error.login.failed
1520939110862   Sync.Service    DEBUG   Fetching unlocked auth state returned service.master_password_locked
1520939110862   Sync.ErrorHandler   ERROR   Sync encountered a login error

但是我並沒有設定master password。如果試著去建立一個master password，則會有"unable to change master password"的訊息。

由於我曾經在Nightly、Beta、Stable之間切換，因此我猜可能是改版造成的問題。然而，試了各種版本後，問題依舊。

此時，我懷疑可能我的profile有損毀的情況。官方說法是如果把Firefox降版，而profile沿用，有可能會發生。之前研究過Firefox Sync，他需要把登入用的一些資訊存在Firefox的password storage中。Profile損毀的話的確有可能會無法sync。

然而，用firepwd解密我的profile，又可以正常印出Firefox Sync登入用的資訊，所以問題可能出在Firefox本身。

首先，將signon.debug設為true，可以多印出一些訊息。從訊息中可以得知logins.json中的username和password解密失敗。

根據firepwd提供的Firefox密碼解密原理說明，解密需要一把3DES的key，而這把key會用一組key ID來操作。

我自行編譯mozilla-central，再gdb後，發現Firefox可以解開所需的key ID，但找不到所對應的key。

根據firepwd，3DES key是存在key3.db或key4.db中，然而讀取這兩種db的函數都沒有被執行到，表示key3.db或key4.db都沒有被讀進來。strace也給出相同的結論。

接著發現在initialize NSS module時，configdir為空，因此NSS不會去找key3.db或是key4.db。我原本以為profile裡面設定錯誤，但看pkcs11.txt和secmod.db似乎都沒問題。

最後發現如果security.nocertdb為true，就會把config設為空，因此整個解密的過程都無法進行。

經過一番回想，當初設定這個參數是為了讓Firefox不要保留SSL immediate certificate，沒想到這個參數還有副作用。我猜他的本意是：不要讀取或寫入任何在permanent storage上和密碼以及安全有關的資料。沒了immediate certificate，也沒了password storage。

現在只好先改回來，等哪天發現有更好的辦法可以disable immediate certificate，不然一大堆immediate certificate列在那邊實在很礙眼。

解決Arch Linux下emoji的顯示

2018-01-22T14:46:00+08:00

KeePassXC在entry view裡加了不少欄位，其中一個是paperclip (📎, U+1F4CE)。在macOS正常，但在Arch Linux無法正常顯示，只有一個方框。裝了noto-fonts-emoji之後就正常了。

根據Arch Linux Wiki的說明，fontconfig會自動選一個有emoji的字型，所以理論上系統只要裝一個就好。有看到一個比較花俏的emoji字型，改天有空再來玩玩。

裝了noto-fonts-emoji之後，xfwm4也可以正常顯示emoji了。現在剩下的問題就是QTerminal/Konsole無法處理UCS-4...

AUR cleanup

2018-01-12T21:51:00+08:00

今天把yan12125/aur裡已經disowned的package都刪掉了。

yan12125/aur@47252d3d8020c1011068587355270d9ae62b9db5

有種斷捨離的感覺...

有些曾經是我追尋的目標，有則完全想不起來當初是用來做什麼的。無論如何，過去的，總是該過去了。

一些印象：

boringssl-aur：在搞aur自動上傳的時候加的。pygit2 -> libgit -> libssh2
firefox-adblock-plus-hg：當初好像adblock plus有一些bug，只有在hg上的版本是正常運作的。現在我跳槽到ublock origin，而Firefox預設也不能安裝沒有數位簽章的外掛了。
flashplugin-beta：看到Phoronix上Adobe Flash要重新支援Linux的新聞。有些網站在舊的Flash (11.x)上不執行，就去打包這個。在這之前，用PPAPI轉NPAPI的外掛用了一段時間，常常會有不穩定的情況。
gcc46-multilib：印象中是舊版的是AOSP或Firefox OS用到的。
js45：很多project (e.g. libproxy)用了舊版的spidermonkey，我試著porting了一些，都沒有upstream。中間送了不少build system patch給mozilla。後來gjs用到了js45，他就進官方repo了。
k-map：大二修交換電路的時候打包的，算是我最早的幾個package之一。原來我用了Arch之後不久就開始打包package了。用Ubuntu一年多都沒打包過，Arch真的會改變一個人的思維。
lxqt-panel-git：在還沒成為lxqt member時，曾短暫維護這個package一陣子。
megatools-dev-git：本以為會是下一版megatools，想不到舊的branch更新還比較多。
mips-mentor-linux-gnu：似乎是計算機結構的final project跑一個simulator用的。
purple-line-git：本來希望可以在Linux上用LINE，結果把LINE帳號搞的亂七八糟的。也不支援貼圖。
pyalpm-git：pyalpm有些bug的時候維護的，似乎是和新版Python不相容
pypy3-hg：在pypy3還沒到3.5-compatible的時候用的
python-pysvn：一個難搞的package，C++有太多陷阱
tamarin-redux-hg：以前用來研究ActionScript的，後來Flash慢慢消失了
xx-net：曾經想要做成package，就不用常常從git抓，然而XX-Net的設計理念不適合做成package

這裡面js45 (libproxy), pypy3-hg, tamarin-redux-hg, xx-net多少和youtube-dl有關係。想想從youtube-dl出來的side project還真不少。後來有些變成單獨的project了，例如python3-android。研究VPN, proxy等等的過程中，也了解的不少中國網路的困境，進而對中國政治產生一些興趣。

順帶一提，youtube-dl一開始是為了讓女友可以載streetvoice上的音樂才認真去研究的。說來可以算是從小打小鬧進入嚴肅的open source世界的濫觴。有空再來寫單獨一篇XD

解決郵局webatm「請檢查晶片是否已依正確方向插入讀卡機」的問題

2017-11-02T23:47:00+08:00

郵局的webatm只要一台USB讀卡機和~~萬惡的~~IE，就可以在家裡轉帳、查交易紀錄等等，非常方便。

之前我都是用VirtualBox開一個Win7的VM，再用USB轉接功能讓裡面的Win7可以使用讀卡機。在Linux host跟Mac host用過，都沒啥問題。

然而，前幾天要轉帳的時候，照著往常的步驟，卻一直跳出「請檢查晶片是否已依正確方向插入讀卡機」的錯誤訊息。查了不少資料，試過不少方法：

將Certificate Propagation服務停用。仍舊出現錯誤
將Smart Card停用再啟用，還是無效
把卡片用力壓，沒用
用橡皮擦把晶片的地方擦一擦，沒用

查了那麼多資料，我都覺得好像在到處亂找偏方XD

後來想想，可能是VirtualBox的問題。找了一台有裝Windows的電腦，一插上去，還真的可以用。

檢查了一下VirtualBox的設定，發現沒有裝VirtualBox Extension Pack。下載最新版的回來安裝，再把USB設定成USB 2.0就OK了。

我以前以為Extension Pack是OSE版的才要裝，想不到PUEL的也要囧

BTW，想不到我竟然會有一天需要用Wayback Machine來放PTT的連結...希望PTT趕快好起來啊。PTT 2017/10/30 故障事件

Revert Revert Revert Revert

2017-10-25T11:53:00+08:00

在AOSP的Gerrit上看到一個commit message很有趣的review request。

這樣做的好像還不少，從Github的搜尋可以略知一二XD

安裝 Pelican

2017-10-15T01:31:00+08:00

來玩玩自己的部落格～把pelican裝起來，寫篇測試文章

TODO:

Deploy - 用git hook似乎是個選項
Themes - http://www.pelicanthemes.com/上面滿多選擇的
Git設定 - .gitignore, 放到Github等等
設定文章網址，讓他裡面有日期
字型 - 標題預設的中文字型頗怪

可能會做的事：

留言系統 - farseerfc分享了一個相當有趣的點子：使用Github issues當作留言系統。不過我還是別用那麼geek的系統好了。

UPDATE 2017/10/23:

Deploy懶得研究那麼多了XD 直接在server上clone一份，Apache的設定檔指過去，搞定收工！
先放到我自己的gogs server，有空再來放github
用ARTICLE_URL和PAGE_URL設定好了有日期的網址。官方教學用*_SAVE_AS來達到沒有.html的效果。我個人是覺得直接用xxx.html就好啦。

幾個小抱怨點：

預設提供的Makefile不會先clean再輸出，沒注意的話改網址的時候會留下沒用的檔案
ARTICLE_URL和ARTICAL_URL_SAVE_AS必須兩個同時設定，否則文章會連不到，不太直覺。

有趣的書名

2017-09-20T23:54:00+08:00

之前有出現過一波「從入門到XX」系列的惡搞書名，例如「PHP: 從入門到出軌」、「C語言：從入門到放棄」等等。這些都是惡搞合成的圖片。不過最近看到有人真用這種句型寫書，標題就叫「Puppet：從入門就放棄」，不過內容倒是一本正經XD

Mac shortcuts are broken with UTF-8

2017-09-16T12:51:00+08:00

I was trying to enable copying and pasting between Linux and macOS via SSH. I followed several guides (1 2 3) and set up a local server to handle exchanged clipboard data. OK, things look good.

However, soon I found that pasting CJK brings question marks. A tip suggests setting __CF_USER_TEXT_ENCODING, which doesn't work for me. I ended up changing the content of ~/.CFUserTextEncoding to 0x8000100:0x8000100. After reboot, copying and pasting CJK just works (TM).

But something strange hits me. Quite a few shortcuts involving Command doesn't work in Firefox and KeePassXC. With some trial and error, it turns out modified ~/.CFUserTextEncoding broke things. I have no choice but changing it back.

KeePassXC uses QShortcut and Firefox appears to use Cocoa directly. What stops them from working? Dunno.

0x8000100 is exactly UTF-8. So, another amazing story of macOS: using UTF-8 as the default encoding can break things!

Network is down after logged out

2017-08-22T11:20:00+08:00

Recently I got a mysterious bug. I have a server, and whenever I logouts all sessions, its network is broken. I can neither ping it nor ssh into it.

The culprit is NetworkManager. "All users may connect to this network" is not checked, so only my account can access the network.

Reference: https://www.centos.org/forums/viewtopic.php?t=49267

Select printer with lpr

2017-08-20T00:00:00+08:00

On Arch Linux, I use the following command to print documents:

PRINTER="the_printer_name" lpr ~/my_doc.pdf

It was always working yet broken with the latest version. A mysterious error appears:

$ PRINTER="the_printer_name" lpr ~/my_doc.pdf
lpr: Error - scheduler not responding.

By tracing the codes, seems $PRINTER does not work. Now I have to use another pattern to specify the printer:

$ lpr -P "the_printer_name" ~/my_doc.pdf

After debugging and tracing codes, it turns out that the bug is already fixed upstream. I applied the package and rebuild CUPS. Now everything is fine :)

youtube-dl on Android

2015-11-22T17:06:00+08:00

最近在研究如何把youtube-dl跑在Android上(youtube-dl#967)。方法大致如下：

找一個可以跑的Python interpreter
把youtube-dl clone下來或是從yt-dl.org下載最新的tarball
用adb shell或terminal emulater執行youtube-dl

針對第一步，Google Play上面很多個，例如Kivy Launcher，QPython3等等。我玩過之後都不太滿意。因為這些App要嘛我找不到一個單獨的python執行檔，要嘛是在app自己的資料夾下，shell讀不到。於是我決定用自己compile的版本。在網路上找"Python NDK"，找到了python3-android這個project。照著說明下去跑，沒有compile error，看起來很棒。放到手機上，設定好LD_LIBRARY_PATH就可以用，也不錯，不過一跑youtube-dl就出錯：

root@GT-N7000:/data/local/tmp # python3 youtube_dl/__main__.py
Traceback (most recent call last):
  File "youtube_dl/__main__.py", line 16, in <module>
    import youtube_dl
  File "/data/local/tmp/youtube_dl/__init__.py", line 15, in <module>
    from .options import (
  File "/data/local/tmp/youtube_dl/options.py", line 7, in <module>
    from .downloader.external import list_external_downloaders
  File "/data/local/tmp/youtube_dl/downloader/__init__.py", line 3, in <module>
    from .common import FileDownloader
  File "/data/local/tmp/youtube_dl/downloader/common.py", line 8, in <module>
    from ..compat import compat_str
  File "/data/local/tmp/youtube_dl/compat.py", line 14, in <module>
    import subprocess
  File "/data/local/tmp/python3/lib/python3.4/subprocess.py", line 406, in <module>
    import select
ImportError: dlopen failed: cannot locate symbol "ceil" referenced by "select.cpython-34m.so"...

在另外一台手機HTC butterfly x920上error不太一樣：

shell@android:/data/local/tmp $ python3 -c 'import select'
Traceback (most recent call last):
  File "<string>", line 1, in <module>
ImportError: Cannot load library: reloc_library[1306]:  2142 cannot locate 'ceil'...

在網路上找到這篇，他說select需要link libm.so，我照做了之後select就可以被import進來了。

接下來是這個問題：

shell@android:/ $ python3 -c 'import platform; platform.platform()'
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/data/local/tmp/python3/lib/python3.4/platform.py", line 1470, in platform
    system, node, release, version, machine, processor = uname()
  File "/data/local/tmp/python3/lib/python3.4/platform.py", line 1151, in uname
    processor = _syscmd_uname('-p', '')
  File "/data/local/tmp/python3/lib/python3.4/platform.py", line 905, in _syscmd_uname
    f = os.popen('uname %s 2> %s' % (option, DEV_NULL))
  File "/data/local/tmp/python3/lib/python3.4/os.py", line 943, in popen
    bufsize=buffering)
  File "/data/local/tmp/python3/lib/python3.4/subprocess.py", line 859, in __init__
    restore_signals, start_new_session)
  File "/data/local/tmp/python3/lib/python3.4/subprocess.py", line 1357, in _execute_child
    raise RuntimeError('Could not find system shell')
RuntimeError: Could not find system shell

看了下subprocess.py，這段code是python3-android的patch：

import platform
if platform.android_version()[0]:
    main = '/system/bin/sh'
else:
    raise RuntimeError('Could not find system shell')

在蝴蝶機上platform.android_version()給出的是('', '')，於是我又看了下android_version()的定義：

output = subprocess.check_output(['/system/bin/getprop',
                                  _android_version_property])
version = output.decode('ascii').strip()
version_obtained = True

奇怪的是，我在shell裡直接打/system/bin/getprop ro.build.version.release就會有正確的值4.1.1，用python下subprocess.check_output(['/system/bin/getprop', 'ro.build.version.release'])或是subprocess.check_output(['/system/bin/getprop'])都給我b''。strace一下也沒啥發現。只好來改falling back讀檔案的部份。

不得不說這部份真是bug百出，原作者應該沒有好好的在各種手機上測過，最後改完大概像這個樣子。

這兩個地方我把改過的部份送回上游python3-android#10，pull request裡也有說明我遇到的各種情況。

現在大致上可以跑了，除了SSL CERTIFICATE_VERIFY_FAILED之外：

shell@android:/sdcard/Android/data/me.sheimi.sgit/files/repo/ytdl $ python3 -m youtube_dl -v cnFmi7AXeK8
[debug] System config: []
[debug] User config: []
[debug] Command-line args: ['-v', 'cnFmi7AXeK8']
[debug] Encodings: locale ascii, fs utf-8, out ascii, pref ascii
[debug] youtube-dl version 2015.11.19
[debug] Python version 3.4.3 - Linux-3.4.10-ga9fe3b3-armv7l-with-libc
[debug] exe versions: none
[debug] Proxy map: {}
[youtube] cnFmi7AXeK8: Downloading webpage
ERROR: Unable to download webpage: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:600)> (caused by URLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:600)'),))
    response = self._open(req, data)
  File "/storage/sdcard0/Android/data/me.sheimi.sgit/files/repo/ytdl/youtube_dl/extractor/common.py", line 329, in _request_webpage
    return self._downloader.urlopen(url_or_request)
  File "/storage/sdcard0/Android/data/me.sheimi.sgit/files/repo/ytdl/youtube_dl/YoutubeDL.py", line 1874, in urlopen
    return self._opener.open(req, timeout=self._socket_timeout)
  File "/data/local/tmp/python3/lib/python3.4/urllib/request.py", line 463, in open
  File "/data/local/tmp/python3/lib/python3.4/urllib/request.py", line 481, in _open
    '_open', req)
  File "/data/local/tmp/python3/lib/python3.4/urllib/request.py", line 441, in _call_chain
    result = func(*args)
  File "/storage/sdcard0/Android/data/me.sheimi.sgit/files/repo/ytdl/youtube_dl/utils.py", line 798, in https_open
    req, **kwargs)
  File "/data/local/tmp/python3/lib/python3.4/urllib/request.py", line 1184, in do_open
    raise URLError(err)

這是個老問題了youtube-dl ssl certificate_verify_failed，一個常見的解法是設定$SSL_CERT_DIR，但是我設了/system/etc/security/cacerts還是失敗，strace一下：

stat64("/system/etc/security/cacerts/578d5c04.0", 0xbe99c130) = -1 ENOENT (No such file or directory)
stat64("/system/etc/security/cacerts/2c543cd1.0", 0xbe99c130) = -1 ENOENT (No such file or directory)
stat64("/system/etc/security/cacerts/c4c7a654.0", 0xbe99c130) = -1 ENOENT (No such file or directory)

Android的確沒有這三個檔案，而Arch Linux上有2c543cd1.0和578d5c04.0，莫非Android上的根憑證和一般人不一樣？

EDIT 2019-09-21

後來certificate的問題解決了。詳細可參考python3-android SSL/TLS。

助教見聞錄 - 沒有回傳值的non-void函數

2015-11-18T02:09:08+08:00

昨天有位小大一來問問題，他寫的code在local可以跑，但是上傳到Judgegirl都是wrong answer。

我看了一下題目，是要用遞迴計算 $1^2 + 2^2 + \ldots + n^2$ 。他的code大概長這樣：

#include <stdio.h>
int squares(int n)
{
    int t = 0;
    if (n == 1)
    {
        t += 1;
        return t;
    }
    else
    {
        t += n * n + squares (n - 1);
        return;
    }
}

int main()
{
    printf("%d\n", squares (5));
    return 0;
}

用gcc編譯：gcc squares.c

執行結果：

$ ./a.out
55

看起來是對的，$1^2 + 2^2 + 3^2 + 4^2 + 5^2 = 55$，為何judge不過？

其實滿明顯的，第二個return應該是return t才對。

問題來了，為何結果是對的？

這得從x86 calling convention開始講起（維基百科）。一般的x86程式中，函數執行到return時是把return value放進eax暫存器中，然後jump回去。看看這兩個函數的assembly即可見真章：

$ gdb ./a.out
Reading symbols from ./a.out...(no debugging symbols found)...done.
(gdb) disassemble squares
Dump of assembler code for function squares:
   0x0000000000400506 <+0>: push   rbp
   0x0000000000400507 <+1>: mov    rbp,rsp
   0x000000000040050a <+4>: push   rbx
   0x000000000040050b <+5>: sub    rsp,0x28
   0x000000000040050f <+9>: mov    DWORD PTR [rbp-0x24],edi
   0x0000000000400512 <+12>:    mov    DWORD PTR [rbp-0x14],0x0
   0x0000000000400519 <+19>:    cmp    DWORD PTR [rbp-0x24],0x1
   0x000000000040051d <+23>:    jne    0x400528 <squares+34>
   0x000000000040051f <+25>:    add    DWORD PTR [rbp-0x14],0x1
   0x0000000000400523 <+29>:    mov    eax,DWORD PTR [rbp-0x14]
   0x0000000000400526 <+32>:    jmp    0x400543 <squares+61>
   0x0000000000400528 <+34>:    mov    eax,DWORD PTR [rbp-0x24]
   0x000000000040052b <+37>:    imul   eax,DWORD PTR [rbp-0x24]
   0x000000000040052f <+41>:    mov    ebx,eax
   0x0000000000400531 <+43>:    mov    eax,DWORD PTR [rbp-0x24]
   0x0000000000400534 <+46>:    sub    eax,0x1
   0x0000000000400537 <+49>:    mov    edi,eax
   0x0000000000400539 <+51>:    call   0x400506 <squares>
   0x000000000040053e <+56>:    add    eax,ebx
   0x0000000000400540 <+58>:    add    DWORD PTR [rbp-0x14],eax
   0x0000000000400543 <+61>:    add    rsp,0x28
   0x0000000000400547 <+65>:    pop    rbx
   0x0000000000400548 <+66>:    pop    rbp
   0x0000000000400549 <+67>:    ret
End of assembler dump.
(gdb) disassemble main
Dump of assembler code for function main:
   0x000000000040054a <+0>: push   rbp
   0x000000000040054b <+1>: mov    rbp,rsp
   0x000000000040054e <+4>: mov    edi,0x5
   0x0000000000400553 <+9>: call   0x400506 <squares>
   0x0000000000400558 <+14>:    mov    esi,eax
   0x000000000040055a <+16>:    mov    edi,0x4005f4
   0x000000000040055f <+21>:    mov    eax,0x0
   0x0000000000400564 <+26>:    call   0x4003e0 <printf@plt>
   0x0000000000400569 <+31>:    mov    eax,0x0
   0x000000000040056e <+36>:    pop    rbp
   0x000000000040056f <+37>:    ret
End of assembler dump.

DWORD PTR [rbp-0x24]是edi，也就是第一個function argument rdi的lower bits，換句話說就是n。squares+34把n的值放到eax，squares+41之後ebx的值是n * n。squares+43～squares+51把squares(n - 1)的值算出來放到eax，squares+56之後eax的值就是n * n + squares(n - 1)。這時候直接return答案剛好會是對的。

就這樣，一連串的剛剛好，最後出來剛好結果是對的。然而judge上的compiler跟我們自己的compiler不一定一樣，這種undefined behavior，結果就很難說了。

這樣的解釋，學弟好像聽不太懂，不過沒關係，岱神聽懂就好了^__^

Installing Octopress

2015-11-17T00:54:31+08:00

弄個部落格放一些技術文章是我一直想做的事。之前試過幾個平台，例如PTT，Wordpress等等，都覺得差強人意。主要是貼code很不方便。有一次看到有人部落格用Octopress架站，好奇之下查了一些資料，發現他可以用Markdown寫文章，就下定決心要來試試看。

我測試的環境是家裡電腦，系統是Arch Linux。折騰了兩三個小時，終於把Octopress裝起來了。過程中最大的問題是Octopress 3.x之後用的指令都跟2.x完全不同，最後用的指令如下：

$ git init
$ octopress new .
$ jekyll build
$ octopress deploy init rsync
$ vim _deploy.yml
$ octopress deploy

其中關鍵的地方是第二行octopress new . 如果照著官方教學用octopress init .，出來的HTML就沒有style。用以上步驟建出來的雖然不如官網的那麼漂亮，但也不錯看了。

另外一個麻煩的地方是_deploy.yml的設定。由於標準的rsync URI要有兩個冒號，例如：

yen@localhost::octopress/

而Octopress的路徑是rsync over ssh，只有一個冒號，所以_deploy.yml的remote_path我另外加了一個冒號在前面。希望未來的版本能直接支援一般的rsync protocol。

架好之後，用jekyll serve -w就會在localhost:4000開一個server，markdown存檔時會自動重新build，相當方便。

Welcome to Jekyll!

2015-11-16T19:20:00+08:00

You’ll find this post in your _posts directory. Go ahead and edit it and re-build the site to see your changes. You can rebuild the site in many different ways, but the most common way is to run jekyll serve, which launches a web server and auto-regenerates your site when a file is updated.

To add new posts, simply add a file in the _posts directory that follows the convention YYYY-MM-DD-name-of-post.ext and includes the necessary front matter. Take a look at the source for this post to get an idea about how it works.

Jekyll also offers powerful support for code snippets:

def print_hi(name)
  puts "Hi, #{name}"
end
print_hi('Tom')
#=> prints 'Hi, Tom' to STDOUT.

Check out the Jekyll docs for more info on how to get the most out of Jekyll. File all bugs/feature requests at Jekyll’s GitHub repo. If you have questions, you can ask them on Jekyll Talk.

Compiling ZTE OPEN kernel on Arch Linux

2015-08-12T13:29:00+08:00

I need to modify kernel source codes of Firefox OS for my project. Currently I have a ZTE OPEN device (NOTE: it's different from ZTE OPEN C). ZTE have lots of kernel sources released to public, but this device is not included. After several e-mails, ZTE engineers finally release the kernel source for this device. Cheers!

After several days of trials and errors, I finally compiled and installed the kernel image. I use Arch Linux. This distribution features all softwares being latest. Here's an incomplete list of my installed softwares:

gcc-multilib 5.2.0-2
perl 5.22.0-1
python2 2.7.10-1

And here's how I've compiled the kernel:

First download the kernel source image from http://opensource.ztedevice.com/. Choose the "ZTE OPEN Icecream Sandwich Kernel(3.0.X)" one.

Extract the kernel source:

$ tar zxvf "ZTE_OPEN_Icecream_Sandwich_Kernel(3.0.X).tar.gz"

Download arm-eabi-gcc from google:

$ git clone https://android.googlesource.com/platform/prebuilts/gcc/linux-x86/arm/arm-eabi-4.6

Go into the compiler and add the \$PATH

$ pushd arm-eabi-4.6/bin
$ export PATH=$PATH:`pwd`
$ hash -r
$ popd

Go into the kernel source and check arm-eabi-gcc works
```
$ arm-eabi-gcc -v
```
You shoud find the last line like "gcc version 4.6.x-google 20120106 (prerelease) (GCC)"
Make sure the system python interpreter is python 2:
```
$ python -V
  Python 2.7.10
```
If not 2.7.x, run the following commands:
```
$ mkdir python2_dir
$ pushd python2_dir 
$ ln -s /usr/bin/python2 python
$ export PATH=`pwd`:$PATH
$ popd
```
This step is necessary on Arch Linux and a very few distributions only. On most systems the default is already python 2.
Modify script/gcc-wrapper.py and add the following lines:

Configure the kernel

$ make ARCH=arm CROSS_COMPILE=arm-eabi- msm7627a-roamer2_ath_mipi_defconfig

Build the kernel image

$ make ARCH=arm CROSS_COMPILE=arm-eabi-

Now the kernel image is in arch/arm/boot/zImage. The next step is to integrate existing initramfs with the new zImage.

Android/Firefox OS boot.img is a special format. For normal Linux distributions, zImage (vmlinuz) and initrd.gz are the two files necessary for successful booting. On Android/Firefox OS, the two files are integrated into a single file. That is boot.img. The handy tool abootimg can extract and create this file. Here's the steps to generate the new boot.img:

Get the original boot.img. This file can be found in factory images. I use "OPEN(American Standard) SD card upgrading instruction & software package(ebay)-237620B0669OPEN_US_DEV_FFOS_V1.1.0B02(for V1.1)" from http://www.ztedevice.com/support/smart_phone/b5a2981a-1714-4ac7-89e1-630e93e220f8.html

Extract boot.img:

$ unzip 2014012010173938.zip
$ cd OPEN\(American\ Standard\)\ SD\ card\ upgrading\ instruction\ \&\ software\ package\(ebay\)-237620B0669OPEN_US_DEV_FFOS_V1.1.0B02\(for\ V1.1\)
$ unzip US_DEV_FFOS_V1.1.0B06_UNFUS_SD_For_V1.1.zip boot.img

Extract initrd from boot.img:
```
$ abootimg -x boot.img
```

Generate the new boot.img:

$ abootimg --create boot_new.img -f bootimg.cfg -k ../kernel/arch/arm/boot/zImage -r initrd.img

Finally, burn the new boot.img into the device. You need adb and fastboot installed.

Enter download mode
```
$ adb reboot-bootloader
```

Burn the new boot.img

$ fastboot flash boot boot_new.img && fastboot continue

Now you can check the new kernel is written:

$ adb shell cat /proc/version
Linux version 3.0.21 (yen@PC951) (gcc version 4.6.x-google 20120106 (prerelease) (GCC) ) #1 SMP PREEMPT Wed Aug 12 03:29:06 CST 2015

Mixed encoding content converter

2015-07-12T23:03:00+08:00

標題可能下的含糊不清，意義不明，且讓我娓娓道來

昨天，我用youtube-dl從酷我音樂上載了林俊傑的江南下來。載下來的檔案是ape格式，我還是第一次看到，用VLC開一堆error，所以我就用mpv聽：

$ mpv 江南-93157.ape
Playing: 江南-93157.ape
 (+) Audio --aid=1 (ape)
File tags:
 Artist: ÁÖ¿¡½Ü
 Album: ½ÄÏ
 Genre: R&B
 Title: ½ÄÏ
 Track: 2
AO: [pulse] 44100Hz stereo 2ch s16
A: 00:00:01 / 00:04:27 (0%)

一切都很好，除了metadata那邊一堆亂碼。（後來發現他們是GB2312）ffprobe出來的結果也差不多：

$ ffprobe ~/Music/songs/江南-93157.ape
ffprobe version 2.7.1 Copyright (c) 2007-2015 the FFmpeg developers
  built with gcc 5.1.0 (GCC)
  configuration: --prefix=/usr --disable-debug --disable-static --disable-stripping --enable-avisynth --enable-avresample --enable-fontconfig --enable-gnutls --enable-gpl --enable-libass --enable-libbluray --enable-libfreetype --enable-libfribidi --enable-libgsm --enable-libmodplug --enable-libmp3lame --enable-libopencore_amrnb --enable-libopencore_amrwb --enable-libopenjpeg --enable-libopus --enable-libpulse --enable-libschroedinger --enable-libspeex --enable-libssh --enable-libtheora --enable-libv4l2 --enable-libvorbis --enable-libvpx --enable-libx264 --enable-libx265 --enable-libxvid --enable-shared --enable-version3 --enable-x11grab
  libavutil      54. 27.100 / 54. 27.100
  libavcodec     56. 41.100 / 56. 41.100
  libavformat    56. 36.100 / 56. 36.100
  libavdevice    56.  4.100 / 56.  4.100
  libavfilter     5. 16.101 /  5. 16.101
  libavresample   2.  1.  0 /  2.  1.  0
  libswscale      3.  1.101 /  3.  1.101
  libswresample   1.  2.100 /  1.  2.100
  libpostproc    53.  3.100 / 53.  3.100
Input #0, ape, from '江南-93157.ape':
  Metadata:
    title           : ½ÄÏ
    artist          : ÁÖ¿¡½Ü
    album           : ½ÄÏ
    encoded_by      : Exact Audio Copy   (Secure mode)
    track           : 2
    genre           : R&B
    date            : 2004
  Duration: 00:04:27.95, start: 0.000000, bitrate: 907 kb/s
    Stream #0:0: Audio: ape (APE  / 0x20455041), 44100 Hz, stereo, s16p

我就猜是ffmpeg的問題。首先先確定這些metadata是哪種格式：

$ file 江南-93157.ape
江南-93157.ape: Audio file with ID3 version 2.3.0, contains: Monkey's Audio compressed format version 3970 with fast compression, stereo, sample rate 44100

嗯是ID3v2 2.3。ID3v2的header開頭是"ID3"。先在ffmpeg的code裡搜尋這個字串：

$ grep -r '"ID3"'
libavformat/asfdec_o.c:            else if (!strcmp(name, "ID3")) // handle ID3 tag
libavformat/asfdec_f.c:        } else if (!strcmp(key, "ID3")) { // handle ID3 tag
libavformat/id3v2.h: * Default magic bytes for ID3v2 header: "ID3"
libavformat/id3v2.h:#define ID3v2_DEFAULT_MAGIC "ID3"

雖然asfdec_f.c跟asfdec_o.c聽起來不太像是decode ape的檔，不過應該都差不多。打開asfdec_o.c來看：

            else if (!strcmp(name, "ID3")) // handle ID3 tag
                get_id3_tag(s, val_len);

一步一步追查下去，可以知道函數呼叫的順序是：

get_id3_tag() in libavformat/asfdec_o.c
ff_id3v2_read() in libavformat/id3v2.c, 3~5也是在這個檔案裡
id3v2_read_internal()
id3v2_parse()
read_ttag()

read_ttag()裡面，他先做decode_str()：

    if (decode_str(s, pb, encoding, &dst, &taglen) < 0) {
        av_log(s, AV_LOG_ERROR, "Error reading frame %s, skipped\n", key);
        return;
    }

decode_str()用到的encoding參數是從前一個byte讀出來的。我下載下來的檔案這個地方是0，也就是ISO-8859-1。不過那些字串顯然不是ISO-8859-1，顯示出來就變成亂碼。

    case ID3v2_ENCODING_ISO8859:
        while (left && ch) {
            ch = avio_r8(pb);
            PUT_UTF8(ch, tmp, avio_w8(dynbuf, tmp);)
            left--;
        }
        break;

這裡的關鍵是PUT_UTF8，他做的事是把UTF-32轉換成UTF-8（詳見libavutil/common.h）。理論上只要把UTF-8轉回UTF-32，再用GB2312顯示出來就可以了。

不過這裡有個問題。ffprobe的結果裡面"江南-93157.ape"那一行是正確的UTF-8，其他有亂碼的地方是GB2312，不能全部用同一種encoding顯示出來。我的作法是每行分開處理。

剛好最近聽到chardet，一個可以自動幫你偵測encoding的python module，我就拿來用用看。最後的code放在這兒。

結果如下，大功告成！

$ ffprobe ~/Music/songs/江南-93157.ape |& convert_encoding.py
Encoding: GB2312 with confidence 0.99

ffprobe version 2.7.1 Copyright (c) 2007-2015 the FFmpeg developers
  built with gcc 5.1.0 (GCC)
  configuration: --prefix=/usr --disable-debug --disable-static --disable-stripping --enable-avisynth --enable-avresample --enable-fontconfig --enable-gnutls --enable-gpl --enable-libass --enable-libbluray --enable-libfreetype --enable-libfribidi --enable-libgsm --enable-libmodplug --enable-libmp3lame --enable-libopencore_amrnb --enable-libopencore_amrwb --enable-libopenjpeg --enable-libopus --enable-libpulse --enable-libschroedinger --enable-libspeex --enable-libssh --enable-libtheora --enable-libv4l2 --enable-libvorbis --enable-libvpx --enable-libx264 --enable-libx265 --enable-libxvid --enable-shared --enable-version3 --enable-x11grab
  libavutil      54. 27.100 / 54. 27.100
  libavcodec     56. 41.100 / 56. 41.100
  libavformat    56. 36.100 / 56. 36.100
  libavdevice    56.  4.100 / 56.  4.100
  libavfilter     5. 16.101 /  5. 16.101
  libavresample   2.  1.  0 /  2.  1.  0
  libswscale      3.  1.101 /  3.  1.101
  libswresample   1.  2.100 /  1.  2.100
  libpostproc    53.  3.100 / 53.  3.100
Input #0, ape, from '江南-93157.ape':
  Metadata:
    title           : 江南
    artist          : 林俊杰
    album           : 江南
    encoded_by      : Exact Audio Copy   (Secure mode)
    track           : 2
    genre           : R&B
    date            : 2004
  Duration: 00:04:27.95, start: 0.000000, bitrate: 907 kb/s
    Stream #0:0: Audio: ape (APE  / 0x20455041), 44100 Hz, stereo, s16p

Placement new

2015-04-21T20:53:00+08:00

For advanced C++ programmers, placement new is nothing special. It can initialize a pre-allocated memory block. However, placement new is more than what you think. It accpets an arbitrary number of arguments of arbitrary types.

See the following code snippet:

#include <iostream>
#include <string>
#include <vector>

void* operator new(size_t sz, const std::string& str, const std::vector& vec) noexcept
{
    try
    {
        std::cerr << str << ' ';
        for(char c : vec)
        {
            std::cerr << c;
        }
    }
    catch(...) {}
    return nullptr;
}

int main()
{
    int* p = new ("Hello", {'w', 'o', 'r', 'l', 'd'}) int;
    return 0;
}

That means, you can put any possible C++ type as the second argument of placement new operators.

Is it used in real cases? In fact, nothrow new operator in standard C++ utilizes this feature. See the implementation in libc++.

Another usage can be found in libgc, a C/C++ garbage collection library.

Bypass kuwo.cn IP filtering 跳過酷我音樂的IP檢測

2015-02-25T21:41:00+08:00

kuwo.cn is a popular music sharing platform in China. Chinese users can enjoy latest and high-quality music on it. However, it exploits some trick to prevent users outside Mainland China from listening music flawlessly. For example, when you visit http://www.kuwo.cn/yinyue/112882/ from a country different from China (Taiwan in my case), you will be redirected to the homepage immediately before you can click the play button and enjoy the relaxing voice. Out of curiousity and my own need, I study a small portion of it source code and find it simple to accomplish such IP filtering, and I also find out a lightweight approach to bypass such restriction.

酷我音樂是一個中國著名的音樂分享平台。中國用戶可以在上面享受最新的高音質音樂。然而，這個網站使用了一些手段來防止中國大陸以外的用戶順利的聽音樂。舉例來說，如果你從一個中國以外的國家連上http://www.kuwo.cn/yinyue/112882/（就我的例子是台灣），你就會在按下播放鈕之前被重新導向到首頁，而無法享受這令人放鬆的嗓音。出於好奇心和我自己的需求，我對他的一小部份原始碼進行研究，發現他是用很簡單的方法來達成這種IP檢測。而我也找出一種輕巧的手段來跳過這種限制。

First, observing the source code of kuwo pages. By default it's not possible to view the source code in the browser due to redirections, so I download the page with curl:

首先，觀察這個網頁的原始碼。由於重新導向的緣故，預設情況下是無法用瀏覽器看到網頁原始碼，於是我用curl下載這個網頁：

$ curl http://www.kuwo.cn/yinyue/112882/
//...previous irrelevant codes omitted 省略前面無關的code...
    /*验证ip是否是国外四国的*/
    function checkIp(){
         jQuery.ajax({
             url : '/yy/PlayCheckIp',
             type : 'get',
             data : "",
             success : function(data){
                 if(data == "{\"stauts\":400}"){
                    window.location='http://www.kuwo.cn';
                 }
             }
         });
    }   
    checkIp();
//...some other codes 一些其他code...

Obviously, the site checks your IP and redirect you to their homepage if you're not welcomed. You can visit http://www.kuwo.cn/yy/PlayCheckIp and see what's in it. The simplest way to escape the awful situation is blocking all traffic to the check point. If the checking request fails, nothing happens. I have done it by adding a custom rule to AdblockPlus. Now I can dive in the ocean of music without annoying redirections!

顯然，這個網站會檢查你的IP，而且在你不受歡迎時把你重新導向到首頁。你可以連上http://www.kuwo.cn/yy/PlayCheckIp看看裡面有什麼。跳脫這種糟糕的情況最簡單的方法是阻擋所有通往檢查點的流量。如果檢查的請求沒有成功，什麼事都不會發生。我在AdblockPlus裡加了一條自訂的過濾條件，然後就成功了。現在我可以徜徉音樂之海而不會遇到惱人的重新導向。

Other sites have some other tricks to prevent non-China users from watching their videos or listening to their songs. Such examples include letv.com and youku.com. Here are some examples:

其他網站有一些其他技巧來阻止非中國的使用者看他們的影片或聽他們的音樂。這樣的例子有樂視和優酷。這兒有些例子：

http://www.letv.com/ptv/vplay/21511001.html

There's a project Unblock Youku aiming on such issues. However, kuwo.cn is not supported as of now. In fact, there's not need to proxy the traffic of kuwo IP detection. Just block and ignore it.

有個專案Unblock Youku力圖解決這些問題，然而到目前為止酷我還沒被支援。實際上也沒有必要轉送酷我IP檢測的流量。只要阻擋然後忽略就行了。

Among these sites, what kuwo.cn uses is the simplest, but maybe it's why there's no discussion about it. I googled PlayCheckIp and got nothing meaningful. I hope this short post can help people outside Mainland China have the same rights to enjoy great music :)

在這些網站裡，酷我用的方法是最簡單的，但這也可能是為何都沒有相關的討論。我在google上搜尋PlayCheckIp沒有得到有用的資訊。我希望這篇文章可以幫助中國大陸以外的使用者也能擁有享受美妙音樂的權利 :)

Tonalities

2014-09-17T18:56:00+08:00

Use my ear with the help of vmpk, it's not difficult to determine the tonality of popular songs. Here are results: http://chyen.twbbs.org/yen/pub/major.html

There is a Matlab toolbox developed by University of Jyväskylä named MIRtoolbox, aiming to analyzing music clips with cutting-edge algorithms. It provides a scientific way to determine the tonality. However, I still like the primitive way :)

Quadcopters from TED.com

2013-09-12T21:56:00+08:00

http://www.ted.com/talks/raffaello_d_andrea_the_astounding_athletic_power_of_quadcopters.html

A video clip played on the first class of Control Systems.

孤單北半球

2013-07-30T19:12:00+08:00

有一天在和幾個同學唸書，有人忽然提到孤單北半球這首歌。這首歌最早是誰唱的？眾說紛紜，不一而足。或曰林依晨，或曰歐得洋。上Google一查，原唱是歐得洋。長久以來，我和幾位同學一直以為是林依晨原唱，竟是個天大的笑話！先入為主的成見和憑空臆測使我們長久以來抱持錯誤的認知，若非網路上訊息的快速流通，孤單北半球這首歌的原唱，只怕是和我們的心靈無緣了。胡適嘗曰：『大膽假設，小心求證』，但在人來人往，駢肩雜沓的年代，連求證也難了，實不可不慎！

歐得洋和林依晨的版本，兩者又是另一個故事。就音色言，各有別致韻味，此乃見仁見智，暫且不表。且說兩者歌詞。以下歐得洋版的歌詞（取自魔鏡歌詞網）：


用我的晚安陪你　吃早餐　記得把想念　存進撲滿
我　望著滿天星　在閃　聽牛郎對織女說　要勇敢

別怕我們在地球　的兩端　看我的問候　騎著魔毯
飛　用光速飛到你面前　要你能看到十字星有北極星作伴

少了我的手臂當枕頭　你習不習慣
你的望遠鏡望不到　我北半球的孤單
太平洋的潮水跟著地球　來迴旋轉
我會耐心地等　隨時歡迎你靠岸

少了我的懷抱當暖爐　你習不習慣
E給你照片看不到　我北半球的孤單
世界再大兩顆真心就能　互相取暖
想念不會偷懶　我的夢通通給你保管

而林依晨版的歌詞則是：


用你的早安陪我　吃晚餐　記得把想念　存進撲滿
我　望著滿天星　在閃　聽牛郎對織女說　要勇敢

不怕我們在地球　的兩端　看你的問候　騎著魔毯
飛　用光速飛到我面前　你讓我看到北極星有十字星作伴

少了你的手臂當枕頭　我還不習慣
你的望遠鏡望不到　我北半球的孤單
太平洋的潮水跟著地球　來迴旋轉
我會耐心地等　等你有一天靠岸

少了你的懷抱當暖爐　我還不習慣
E給你照片看不到　我北半球的孤單
世界再大兩顆真心就能　互相取暖
想念不會偷懶　我的夢通通給你保管

vimdiff一下：

孤單北半球-林依晨.txt

孤單北半球-歐得洋.txt

用你的早安陪我　吃晚餐　記得把想念　存進撲滿 
我　望著滿天星　在閃　聽牛郎對織女說　要勇敢

不怕我們在地球　的兩端　看你的問候　騎著魔毯
飛　用光速飛到我面前　你讓我看到北極星有十字星作伴

少了你的手臂當枕頭　我還不習慣
你的望遠鏡望不到　我北半球的孤單
太平洋的潮水跟著地球　來迴旋轉
我會耐心地等　等你有一天靠岸

少了你的懷抱當暖爐　我還不習慣
E給你照片看不到　我北半球的孤單
世界再大兩顆真心就能　互相取暖
想念不會偷懶　我的夢通通給你保管

用我的晚安陪你　吃早餐　記得把想念　存進撲滿
我　望著滿天星　在閃　聽牛郎對織女說　要勇敢

別怕我們在地球　的兩端　看我的問候　騎著魔毯
飛　用光速飛到你面前　要你能看到十字星有北極星作伴

少了我的手臂當枕頭　你習不習慣
你的望遠鏡望不到　我北半球的孤單
太平洋的潮水跟著地球　來迴旋轉
我會耐心地等　隨時歡迎你靠岸

少了我的懷抱當暖爐　你習不習慣
E給你照片看不到　我北半球的孤單
世界再大兩顆真心就能　互相取暖
想念不會偷懶　我的夢通通給你保管

大多相同，而不同之處畫龍點睛，有如兩人對話。編詞的用心，可見一斑。

中和路 and 永和路

2013-07-22T13:57:00+08:00

「中永和之歌」 http://msuvictor.pixnet.net/blog/post/31737885-%5B%E5%A6%99%E8%A8%80%5D-%E3%80%8C%E7%99%BE%E6%85%95%E9%81%94%E4%B8%AD%E6%B0%B8%E5%92%8C%E3%80%8D-%E8%B7%AF%E5%90%8D%E6%9C%89%E5%A4%A0%E4%BA%82

OpenCV: strange return value of cvWaitKey()

2013-04-20T02:59:00+08:00

In OpenCV, cvWaitKey() might be one of most frequently used functions in interactive applications. For example (code in C++):

while(true)
{
    doSomething();

    if(cvWaitKey() == 27) // 27 is the key code of Escape
    {
        break;
    }
}

This works in Windows, but not work in Ubuntu. Both C++ version and python version can't catch escape key in Ubuntu. So annoying!

To find out what happened, I modify the code to print the return value of cvWaitKey(). The result for escape key is 1048603. Those who often coding might has a sense on this number - it's close to 1048576! In fact, it's 1048576+27. So strange! I google by using keyword "cvWaitKey 1048576", and found A Yahoo group question discussing this. Then I go to OpenCV on SourceForge and download the archived code. My downloaded version is 2.4.5. In modules/highgui/src/window_gtk.cpp, the body of cvWaitKey() is:

CV_IMPL int cvWaitKey( int delay )
{
#ifdef HAVE_GTHREAD
    if(thread_started && g_thread_self()!=window_thread){
        gboolean expired;
        int my_last_key;

        // wait for signal or timeout if delay > 0
        if(delay>0){
            GTimeVal timer;
            g_get_current_time(&timer);
            g_time_val_add(&timer, delay*1000);
            expired = !g_cond_timed_wait(cond_have_key, last_key_mutex, &timer);
        }
        else{
            g_cond_wait(cond_have_key, last_key_mutex);
            expired=false;
        }
        my_last_key = last_key;
        g_mutex_unlock(last_key_mutex);
        if(expired || hg_windows==0){
            return -1;
        }
        return my_last_key;
    }
    else{
#endif
        int expired = 0;
        guint timer = 0;
        if( delay > 0 )
            timer = g_timeout_add( delay, icvAlarm, &expired );
        last_key = -1;
        while( gtk_main_iteration_do(TRUE) && last_key < 0 && !expired && hg_windows != 0 )
            ;

        if( delay > 0 && !expired )
            g_source_remove(timer);
#ifdef HAVE_GTHREAD
    }
#endif
    return last_key;
}

Seems the returned value is not modified in this function. After simple search, I found it's set in icvOnKeyPress():

static gboolean icvOnKeyPress( GtkWidget * /*widget*/,
                GdkEventKey* event, gpointer /*user_data*/ )
{
    int code = 0;

    switch( event->keyval )
    {
    case GDK_Escape:
        code = 27;
        break;
    case GDK_Return:
    case GDK_Linefeed:
        code = '\n';
        break;
    case GDK_Tab:
        code = '\t';
    break;
    default:
        code = event->keyval;
    }

    code |= event->state << 16;

#ifdef HAVE_GTHREAD
    if(thread_started) g_mutex_lock(last_key_mutex);
#endif

    last_key = code;

#ifdef HAVE_GTHREAD
    if(thread_started){
        // signal any waiting threads
        g_cond_broadcast(cond_have_key);
        g_mutex_unlock(last_key_mutex);
    }
#endif

    return FALSE;
}

The consequence is clear: the returned value of cvWaitKey() is not exactly the key code. Practically, I use the code snippet below to detect keys:

while(true)
{
    doSomething();

    if(cvWaitKey() & 0xfffff == 27) // only pick 20 bits from LSB
    {
        break;
    }
}

This is what OpenCV in GTK+ happened. How about other platforms? I examined window_QT.cpp, window_w32.cpp (it's for windows), window_carbon.cpp, window_cocoa.mm (above two are for MacOSX), and all of them give exactly the key code from from underlying library in cvWaitKey(). I searched on the svn repository, and found that revision 617 is the first time window_gtk.cpp emerged. Then I searched in branch MACOSX_DEVELOPMENT. The first time window_gtk.cpp appeared is revision 508. Here the strange line exists, and from the commit log, I can find nothing.

Again, it's an example that cross-platform libraries behave differently on different platforms. But this time the condition is slightly different: the difference is caused by totally different codes, but not the programmer's insufficient sense on specific platforms.

SFTP initial path

2013-04-20T02:33:00+08:00

Google "sftp default path"，大多數是用chroot的方式。但我的需求是一開始先切換到某個home以外的目錄，而不是將user鎖在某個目錄底下。轉念一想，sftp-server也只是一個用user的身份執行的process，其實只要從.bashrc或.profile之類的檔案下手即可。

首先看看Ubuntu的default .bashrc的前幾行(在/etc/skel/.bashrc)：

# ~/.bashrc: executed by bash(1) for non-login shells.
# see /usr/share/doc/bash/examples/startup-files (in the package bash-doc)
# for examples

# If not running interactively, don't do anything
[ -z "$PS1" ] && return

PS1類似windows下的prompt，當用ssh tunnel或sftp登入時，這個environment variable不存在。如果想要在這幾種登入方法下執行某些指令，必須加在這幾行的前面。我先用"env > ~/tmp_env" 觀察用不同方式登入時environment variables有何不同。結果是用SSH登入時有數個SSH_開始的environment variables。如此即可達成需求（加在.bashrc的最前面）：

# if not in an interactive shell, and login by ssh, then it's sftp
[ -z "$PS1" -a "$SSH_CLIENT" != "" ] && cd ~/export && return

其中cd ~/export是想要的initial path，也可以執行其他command，不過要注意的是不能有輸出（echo之類），否則ssh可能會無法用sftp登入。

Hello world!

2013-04-07T04:13:00+08:00

Welcome to WordPress. This is your first post. Edit or delete it, then start blogging!

It's the second time I install WordPress on my Apache server. The first time is not long ago, but everything seems easier then ever! WordPress is primarily written in PHP, so a little knowledge for PHP is inevitable, but WordPress makes it understandable for non-PHPer. Just some backgrounds of managing server make everything goes well. For those passionate in sharing ideas but not familiar with tips of manipulating computers, online providers are everywhere. There might be bugs and security issues in such a sophisticated system, but the its popularity and the essence of open source makes bug fixing fast. Another exciting feature of WordPress is that I can worry nothing about permission issues. I just extract the archive to my home directory, thus I'm the only owner of all WordPress files. During the installation, I didn't change the permission or the owner of any files or directories. The only step I've done other than editing wp-config.php is create a new user an the corresponding database on the MySQL server. Yesterday I'm playing around on OwnCloud, a Dropbox-like system, which is also written in PHP. That was scary. I was almost driven to mad due to recurring permission issues. I did chown and chgrp and chmod again and again, but I was still not satisfied with the result. The primary issue is that Apache server runs as the user www-data, but I hope it has the permission to read and write ONLY the files and directories that I specified for OwnCloud. I've tried apache2-mpm-itk and suPHP, but neither matched my requirements. Other PHP-based systems, like Gallery 3, have similar problems. (Gallery 3 is even worse because the only way to share pictures is uploading. I can't specify a local directory for picture sharing.) These limitations might be due to security concerns. To prevent attacks, most web applications use their own strict account management systems, and WordPress is not an exception. But if they provide an option of integrating local Linux users into these systems, what will occur? The server might be exposed to the threat from invaders, but it's convenient for many personal content providers like me. I know convenience and security can't coexist in most cases, but the problem I faced now is not inconvenience, but not working!